# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 3 2019 14:51:36 # Log Creation Date: 13.05.2019 10:55:11.162 Process: id = "1" image_name = "expiorer32.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe" page_root = "0x3c6cf000" os_pid = "0x86c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x87c [0247.248] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0247.249] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0247.249] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0247.249] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0247.249] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0247.249] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0247.249] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0247.250] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0247.251] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0247.252] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0247.253] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0247.254] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0247.254] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0250.874] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0250.874] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0250.874] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0250.874] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0250.874] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0250.874] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0250.875] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0250.875] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0253.953] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0253.953] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0257.494] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0257.495] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0257.495] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0257.495] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0257.708] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0257.708] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0257.708] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0257.708] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0258.013] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0258.013] GetProcessHeap () returned 0x2e0000 [0258.014] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20) returned 0x2f40e0 [0258.014] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=25143145539) returned 1 [0258.014] GetTickCount () returned 0x3706e [0258.014] GetCurrentProcessId () returned 0x86c [0258.015] GetTickCount () returned 0x3706e [0258.015] GetTickCount () returned 0x3706e [0258.015] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20) returned 0x2f4108 [0258.015] GetVersion () returned 0x1db10106 [0258.015] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x7) returned 0x2e36c8 [0258.015] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x2f0be8 [0258.015] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f0be8, Size=0x20) returned 0x2f4158 [0258.015] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4158, Size=0x40) returned 0x2f46c8 [0258.015] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x2f4918 [0258.016] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_7D65G9A") returned 0x0 [0258.016] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_7D65G9A") returned 0x84 [0258.016] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e36c8 | out: hHeap=0x2e0000) returned 1 [0258.016] lstrlenW (lpString="Global\\syncronize_") returned 18 [0258.016] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f46c8 | out: hHeap=0x2e0000) returned 1 [0258.016] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x7) returned 0x2e36c8 [0258.016] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x2f0be8 [0258.016] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f0be8, Size=0x20) returned 0x2f4158 [0258.016] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4158, Size=0x40) returned 0x2f46c8 [0258.016] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x304920 [0258.017] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_7D65G9U") returned 0x0 [0258.017] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_7D65G9U") returned 0x88 [0258.017] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e36c8 | out: hHeap=0x2e0000) returned 1 [0258.017] lstrlenW (lpString="Global\\syncronize_") returned 18 [0258.017] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f46c8 | out: hHeap=0x2e0000) returned 1 [0258.017] GetVersion () returned 0x1db10106 [0258.017] GetCurrentProcess () returned 0xffffffff [0258.017] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0258.017] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0258.017] CloseHandle (hObject=0x8c) returned 1 [0258.017] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0258.017] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0258.017] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x2e36c8 [0258.017] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x2f0be8 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f0be8, Size=0x20) returned 0x2f4158 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4158, Size=0x40) returned 0x2f46c8 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f46c8, Size=0x80) returned 0x2f46c8 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f46c8, Size=0x100) returned 0x2f46c8 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x34) returned 0x2f47d0 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f07d8 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f07e8 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f07f8 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0be8 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4810 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c00 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4810, Size=0x8) returned 0x2f4810 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0c18 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4810, Size=0x10) returned 0x2f4810 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c30 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c48 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4810, Size=0x20) returned 0x2f4810 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0c60 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0c78 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07d8, Size=0x8) returned 0x2f07d8 [0258.018] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07e8, Size=0x8) returned 0x2f07e8 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4838 [0258.018] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x2f0c90 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4848 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x2f0ca8 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4848, Size=0x8) returned 0x2f4848 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314940 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4848, Size=0x10) returned 0x2f4848 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314958 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4860 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4848, Size=0x20) returned 0x2f4870 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07d8, Size=0x10) returned 0x2f4848 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07e8, Size=0x10) returned 0x2f4898 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f07d8 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314970 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f07e8 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314988 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f07e8, Size=0x8) returned 0x2f07e8 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f48b0 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3149a0 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f48c0 [0258.019] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3149b8 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f48c0, Size=0x8) returned 0x2f48c0 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4848, Size=0x20) returned 0x314d28 [0258.019] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4898, Size=0x20) returned 0x314d50 [0258.020] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4898 [0258.020] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3149d0 [0258.020] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4848 [0258.020] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3149e8 [0258.020] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4848, Size=0x8) returned 0x2f4848 [0258.020] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x314d78 [0258.020] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x314d98 [0258.020] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0258.020] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f46c8 | out: hHeap=0x2e0000) returned 1 [0258.020] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0258.033] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00 [0258.033] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4360 [0258.033] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4360, Size=0x40) returned 0x2f4720 [0258.033] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x80) returned 0x2f4720 [0258.033] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x100) returned 0x315070 [0258.033] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a00 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a00, Size=0x20) returned 0x2f4360 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4360, Size=0x40) returned 0x2f4720 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x80) returned 0x2f4720 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x100) returned 0x315178 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314a00 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4720 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x8) returned 0x2f4720 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x2f4730 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x10) returned 0x2f4750 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x2f4768 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x2f4360 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4750, Size=0x20) returned 0x2f4788 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1c) returned 0x2f4388 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x2f47b0 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x2f43b0 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314a30 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4720 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40) returned 0x315280 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x8) returned 0x2f4720 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x3c) returned 0x3152c8 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4720, Size=0x10) returned 0x2f4750 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x315310 [0258.034] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x315330 [0258.034] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4750, Size=0x20) returned 0x315350 [0258.035] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x315378 [0258.035] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0258.035] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315070 | out: hHeap=0x2e0000) returned 1 [0258.035] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0258.035] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315178 | out: hHeap=0x2e0000) returned 1 [0258.035] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3158f8 [0258.038] EnumServicesStatusExW (in: hSCManager=0x3158f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0258.038] GetLastError () returned 0xea [0258.038] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x3191f8 [0258.039] EnumServicesStatusExW (in: hSCManager=0x3158f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3191f8, cbBufSize=0x134c, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3191f8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0258.039] CloseServiceHandle (hSCObject=0x3158f8) returned 1 [0258.041] lstrlenW (lpString="Appinfo") returned 7 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0258.042] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.042] lstrlenW (lpString="AudioSrv") returned 8 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0258.042] lstrlenW (lpString="BFE") returned 3 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.042] lstrlenW (lpString="CryptSvc") returned 8 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.042] lstrlenW (lpString="CscService") returned 10 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0258.042] lstrlenW (lpString="DcomLaunch") returned 10 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.043] lstrlenW (lpString="Dhcp") returned 4 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.043] lstrlenW (lpString="Dnscache") returned 8 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.043] lstrlenW (lpString="DPS") returned 3 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.043] lstrlenW (lpString="eventlog") returned 8 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0258.043] lstrlenW (lpString="EventSystem") returned 11 [0258.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.044] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.044] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.044] lstrlenW (lpString="FontCache") returned 9 [0258.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0258.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0258.044] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0258.044] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0258.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0258.044] lstrlenW (lpString="gpsvc") returned 5 [0258.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.044] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.044] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.044] lstrlenW (lpString="iphlpsvc") returned 8 [0258.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.044] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0258.044] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0258.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0258.044] lstrlenW (lpString="LanmanServer") returned 12 [0258.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0258.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0258.044] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0258.044] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0258.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0258.044] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.044] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.044] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.045] lstrlenW (lpString="lmhosts") returned 7 [0258.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.045] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.045] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.045] lstrlenW (lpString="MMCSS") returned 5 [0258.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0258.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0258.045] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0258.045] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0258.045] lstrlenW (lpString="MpsSvc") returned 6 [0258.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.045] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.045] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.045] lstrlenW (lpString="Netman") returned 6 [0258.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0258.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0258.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0258.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0258.045] lstrlenW (lpString="netprofm") returned 8 [0258.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0258.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0258.045] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0258.045] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0258.045] lstrlenW (lpString="NlaSvc") returned 6 [0258.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.045] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.045] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.046] lstrlenW (lpString="nsi") returned 3 [0258.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.046] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.046] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.046] lstrlenW (lpString="PcaSvc") returned 6 [0258.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.046] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.046] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.046] lstrlenW (lpString="PlugPlay") returned 8 [0258.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.046] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.046] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.046] lstrlenW (lpString="Power") returned 5 [0258.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.046] lstrlenW (lpString="ProfSvc") returned 7 [0258.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.046] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.046] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.046] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.046] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.046] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.047] lstrlenW (lpString="RpcSs") returned 5 [0258.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.047] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.047] lstrlenW (lpString="SamSs") returned 5 [0258.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.047] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.047] lstrlenW (lpString="Schedule") returned 8 [0258.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.047] lstrlenW (lpString="SENS") returned 4 [0258.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.047] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.048] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.048] lstrlenW (lpString="Spooler") returned 7 [0258.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.048] lstrlenW (lpString="sppsvc") returned 6 [0258.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0258.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0258.048] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0258.048] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0258.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0258.049] lstrlenW (lpString="SysMain") returned 7 [0258.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.049] lstrlenW (lpString="Themes") returned 6 [0258.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.049] lstrlenW (lpString="TrkWks") returned 6 [0258.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0258.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0258.049] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0258.049] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0258.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0258.049] lstrlenW (lpString="UxSms") returned 5 [0258.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0258.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0258.049] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0258.049] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0258.050] lstrlenW (lpString="WdiServiceHost") returned 14 [0258.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0258.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0258.050] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0258.050] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0258.050] lstrlenW (lpString="WdiSystemHost") returned 13 [0258.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0258.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0258.050] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0258.050] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0258.050] lstrlenW (lpString="WinDefend") returned 9 [0258.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0258.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0258.050] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0258.050] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0258.050] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0258.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0258.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0258.050] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0258.050] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0258.050] lstrlenW (lpString="Winmgmt") returned 7 [0258.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0258.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0258.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0258.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0258.050] lstrlenW (lpString="wscsvc") returned 6 [0258.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0258.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0258.050] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0258.050] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0258.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0258.051] lstrlenW (lpString="wuauserv") returned 8 [0258.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0258.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0258.051] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0258.051] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0258.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0258.051] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3191f8 | out: hHeap=0x2e0000) returned 1 [0258.051] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0258.054] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.054] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.055] lstrlenW (lpString="System") returned 6 [0258.055] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0258.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0258.055] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0258.055] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0258.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0258.055] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0258.055] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0258.055] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.055] lstrlenW (lpString="smss.exe") returned 8 [0258.055] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0258.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0258.056] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0258.056] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0258.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0258.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0258.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0258.056] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.056] lstrlenW (lpString="csrss.exe") returned 9 [0258.056] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.057] lstrlenW (lpString="wininit.exe") returned 11 [0258.057] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.057] lstrlenW (lpString="csrss.exe") returned 9 [0258.057] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.058] lstrlenW (lpString="winlogon.exe") returned 12 [0258.058] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.059] lstrlenW (lpString="services.exe") returned 12 [0258.059] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.059] lstrlenW (lpString="lsass.exe") returned 9 [0258.059] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.060] lstrlenW (lpString="lsm.exe") returned 7 [0258.060] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.060] lstrlenW (lpString="svchost.exe") returned 11 [0258.060] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.061] lstrlenW (lpString="svchost.exe") returned 11 [0258.061] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.061] lstrlenW (lpString="svchost.exe") returned 11 [0258.061] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.062] lstrlenW (lpString="svchost.exe") returned 11 [0258.062] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.063] lstrlenW (lpString="svchost.exe") returned 11 [0258.063] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.063] lstrlenW (lpString="audiodg.exe") returned 11 [0258.063] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.064] lstrlenW (lpString="svchost.exe") returned 11 [0258.064] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.064] lstrlenW (lpString="svchost.exe") returned 11 [0258.064] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.065] lstrlenW (lpString="dwm.exe") returned 7 [0258.065] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.065] lstrlenW (lpString="explorer.exe") returned 12 [0258.065] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.066] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.066] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.066] lstrlenW (lpString="taskhost.exe") returned 12 [0258.067] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.067] lstrlenW (lpString="svchost.exe") returned 11 [0258.067] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0258.068] lstrlenW (lpString="taskeng.exe") returned 11 [0258.068] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.069] lstrlenW (lpString="svchost.exe") returned 11 [0258.069] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.070] lstrlenW (lpString="taskhost.exe") returned 12 [0258.070] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0258.070] lstrlenW (lpString="sppsvc.exe") returned 10 [0258.070] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.071] lstrlenW (lpString="svchost.exe") returned 11 [0258.071] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0258.071] lstrlenW (lpString="push nutrition.exe") returned 18 [0258.071] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0258.072] lstrlenW (lpString="procedures.exe") returned 14 [0258.072] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0258.072] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0258.073] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0258.073] lstrlenW (lpString="scanner-discover.exe") returned 20 [0258.073] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0258.074] lstrlenW (lpString="regression healthcare.exe") returned 25 [0258.074] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0258.074] lstrlenW (lpString="apr_zinc.exe") returned 12 [0258.074] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0258.075] lstrlenW (lpString="computer.exe") returned 12 [0258.075] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0258.075] lstrlenW (lpString="importanceweekend.exe") returned 21 [0258.075] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0258.076] lstrlenW (lpString="warm_absolute.exe") returned 17 [0258.076] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0258.077] lstrlenW (lpString="funding_editing.exe") returned 19 [0258.077] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0258.077] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0258.077] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0258.078] lstrlenW (lpString="friend.exe") returned 10 [0258.078] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0258.079] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0258.079] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0258.079] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0258.079] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0258.080] lstrlenW (lpString="individually_antiques.exe") returned 25 [0258.080] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0258.081] lstrlenW (lpString="embedded.exe") returned 12 [0258.081] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0258.081] lstrlenW (lpString="usually.exe") returned 11 [0258.081] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0258.082] lstrlenW (lpString="bills.exe") returned 9 [0258.082] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0258.083] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0258.083] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0258.084] lstrlenW (lpString="terminal.exe") returned 12 [0258.084] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0258.085] lstrlenW (lpString="ol_refers.exe") returned 13 [0258.085] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0258.085] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0258.085] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0258.086] lstrlenW (lpString="riding analyst.exe") returned 18 [0258.086] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0258.087] lstrlenW (lpString="robots.exe") returned 10 [0258.087] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0258.088] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0258.088] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0258.089] lstrlenW (lpString="dllhost.exe") returned 11 [0258.089] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0258.089] lstrlenW (lpString="dllhost.exe") returned 11 [0258.089] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0258.090] lstrlenW (lpString="expIorer32.exe") returned 14 [0258.091] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 0 [0258.092] CloseHandle (hObject=0xe0) returned 1 [0258.092] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315280 | out: hHeap=0x2e0000) returned 1 [0258.092] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3152c8 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315310 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315330 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315378 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x314a18 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4730 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4768 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4360 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4388 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f47b0 | out: hHeap=0x2e0000) returned 1 [0258.093] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f43b0 | out: hHeap=0x2e0000) returned 1 [0258.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x31b5a8 [0258.093] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x32b5b0 [0258.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.094] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x2f43b0 [0258.094] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f43b0, Size=0x40) returned 0x3169c0 [0258.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.094] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x2f43b0 [0258.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.094] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x2f4388 [0258.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.094] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x2f4360 [0258.094] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4360, Size=0x40) returned 0x316a08 [0258.094] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32b5b0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe")) returned 0x34 [0258.094] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33b5b8 [0258.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34b5c0 [0258.095] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.095] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x2f4360 [0258.095] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4360, Size=0x40) returned 0x316a50 [0258.095] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a50, Size=0x80) returned 0x315280 [0258.095] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315280, Size=0x100) returned 0x317bc8 [0258.095] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.095] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bc8 | out: hHeap=0x2e0000) returned 1 [0258.095] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\expIorer32.exe", lpDst=0x33b5b8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\expIorer32.exe") returned 0x23 [0258.096] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34b5c0 | out: hHeap=0x2e0000) returned 1 [0258.096] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5b8 | out: hHeap=0x2e0000) returned 1 [0258.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x2010020 [0258.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.096] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x2f4360 [0258.096] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.096] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x315948 [0258.096] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0258.096] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0258.096] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0258.096] lstrlenW (lpString="kernel32.dll") returned 12 [0258.096] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4360 | out: hHeap=0x2e0000) returned 1 [0258.097] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0258.097] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0258.097] CreateFileW (lpFileName="C:\\Windows\\System32\\expIorer32.exe" (normalized: "c:\\windows\\system32\\expiorer32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0258.097] ReadFile (in: hFile=0xe0, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0258.112] WriteFile (in: hFile=0xe4, lpBuffer=0x2010020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0258.114] ReadFile (in: hFile=0xe0, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0258.114] CloseHandle (hObject=0xe4) returned 1 [0258.117] CloseHandle (hObject=0xe0) returned 1 [0258.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.117] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x315948 [0258.117] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.117] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x3158f8 [0258.117] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0258.117] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0258.117] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0258.117] lstrlenW (lpString="kernel32.dll") returned 12 [0258.117] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158f8 | out: hHeap=0x2e0000) returned 1 [0258.117] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0258.117] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.118] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2010020 | out: hHeap=0x2e0000) returned 1 [0258.126] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.126] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x315948 [0258.126] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315948, Size=0x40) returned 0x316a50 [0258.126] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a50, Size=0x80) returned 0x33b5d0 [0258.126] lstrlenW (lpString="C:\\Windows\\System32\\expIorer32.exe") returned 34 [0258.126] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0258.126] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x5c) returned 0x315280 [0258.126] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0258.126] RegSetValueExW (in: hKey=0xe0, lpValueName="expIorer32.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\expIorer32.exe", cbData=0x44 | out: lpData="C:\\Windows\\System32\\expIorer32.exe") returned 0x0 [0258.127] RegCloseKey (hKey=0xe0) returned 0x0 [0258.127] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315280 | out: hHeap=0x2e0000) returned 1 [0258.127] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0258.127] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5d0 | out: hHeap=0x2e0000) returned 1 [0258.127] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d5b8 [0258.127] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d5c0 [0258.127] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a18 [0258.127] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a18, Size=0x20) returned 0x315948 [0258.127] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315948, Size=0x40) returned 0x316a50 [0258.127] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a50, Size=0x80) returned 0x33b5d0 [0258.128] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x317bc8 [0258.128] lstrlenW (lpString="") returned 0 [0258.128] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.128] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8c) returned 0x317cd0 [0258.128] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0258.128] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x34d5c0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x34d5c0*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0258.128] RegCloseKey (hKey=0xe0) returned 0x0 [0258.128] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317cd0 | out: hHeap=0x2e0000) returned 1 [0258.128] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.128] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8c) returned 0x317cd0 [0258.128] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0258.128] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x34d5c0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0258.128] RegCloseKey (hKey=0xe4) returned 0x0 [0258.128] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317cd0 | out: hHeap=0x2e0000) returned 1 [0258.129] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0258.129] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.129] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bc8 | out: hHeap=0x2e0000) returned 1 [0258.129] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expIorer32.exe", lpDst=0x33d5b8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expIorer32.exe") returned 0x6b [0258.129] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5c0 | out: hHeap=0x2e0000) returned 1 [0258.129] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d5b8 | out: hHeap=0x2e0000) returned 1 [0258.129] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x2010020 [0258.129] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.129] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x315948 [0258.129] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.129] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x3158f8 [0258.129] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0258.129] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0258.129] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0258.130] lstrlenW (lpString="kernel32.dll") returned 12 [0258.130] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.130] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0258.130] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158f8 | out: hHeap=0x2e0000) returned 1 [0258.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0258.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\expiorer32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0258.131] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0258.145] WriteFile (in: hFile=0xe8, lpBuffer=0x2010020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0258.147] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0258.147] CloseHandle (hObject=0xe8) returned 1 [0258.149] CloseHandle (hObject=0xe4) returned 1 [0258.149] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.149] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x3158f8 [0258.149] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.149] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x315948 [0258.149] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0258.149] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0258.149] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0258.149] lstrlenW (lpString="kernel32.dll") returned 12 [0258.149] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.149] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0258.149] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158f8 | out: hHeap=0x2e0000) returned 1 [0258.149] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2010020 | out: hHeap=0x2e0000) returned 1 [0258.155] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d5b8 [0258.155] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d5c0 [0258.155] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.155] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x3158f8 [0258.155] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3158f8, Size=0x40) returned 0x316a50 [0258.155] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a50, Size=0x80) returned 0x33b5d0 [0258.155] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x317bc8 [0258.155] lstrlenW (lpString="") returned 0 [0258.155] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.155] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8c) returned 0x317cd0 [0258.155] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0258.155] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x34d5c0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0258.155] RegCloseKey (hKey=0xe4) returned 0x0 [0258.155] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317cd0 | out: hHeap=0x2e0000) returned 1 [0258.155] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0258.155] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.155] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bc8 | out: hHeap=0x2e0000) returned 1 [0258.155] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expIorer32.exe", lpDst=0x33d5b8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expIorer32.exe") returned 0x4c [0258.155] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5c0 | out: hHeap=0x2e0000) returned 1 [0258.155] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d5b8 | out: hHeap=0x2e0000) returned 1 [0258.155] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x2010020 [0258.156] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.156] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x3158f8 [0258.156] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.156] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x315948 [0258.156] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0258.156] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0258.156] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0258.156] lstrlenW (lpString="kernel32.dll") returned 12 [0258.156] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158f8 | out: hHeap=0x2e0000) returned 1 [0258.156] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0258.156] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0258.156] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expIorer32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\expiorer32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0258.157] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0258.170] WriteFile (in: hFile=0xe8, lpBuffer=0x2010020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0258.172] ReadFile (in: hFile=0xe4, lpBuffer=0x2010020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2010020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0258.172] CloseHandle (hObject=0xe8) returned 1 [0258.174] CloseHandle (hObject=0xe4) returned 1 [0258.174] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.174] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x315948 [0258.174] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.174] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x3158f8 [0258.174] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0258.174] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0258.174] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0258.174] lstrlenW (lpString="kernel32.dll") returned 12 [0258.174] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3158f8 | out: hHeap=0x2e0000) returned 1 [0258.174] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0258.174] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.174] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2010020 | out: hHeap=0x2e0000) returned 1 [0258.179] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31b5a8 | out: hHeap=0x2e0000) returned 1 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b5b0 | out: hHeap=0x2e0000) returned 1 [0258.180] lstrlenW (lpString="%windir%\\System32") returned 17 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3169c0 | out: hHeap=0x2e0000) returned 1 [0258.180] lstrlenW (lpString="%appdata%") returned 9 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f43b0 | out: hHeap=0x2e0000) returned 1 [0258.180] lstrlenW (lpString="%sh(Startup)%") returned 13 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4388 | out: hHeap=0x2e0000) returned 1 [0258.180] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x316a08 | out: hHeap=0x2e0000) returned 1 [0258.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x2f4388 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4388, Size=0x40) returned 0x316a08 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a08, Size=0x80) returned 0x33b5d0 [0258.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x2f4388 [0258.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1fffc) returned 0x31b5a8 [0258.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x33d5b8 [0258.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34d5c0 [0258.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x2f43b0 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f43b0, Size=0x40) returned 0x316a08 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a08, Size=0x80) returned 0x33b658 [0258.180] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b658, Size=0x100) returned 0x317bc8 [0258.180] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317bc8 | out: hHeap=0x2e0000) returned 1 [0258.180] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x33d5b8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5c0 | out: hHeap=0x2e0000) returned 1 [0258.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d5b8 | out: hHeap=0x2e0000) returned 1 [0258.180] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0258.181] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0258.181] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0258.181] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0258.181] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x89c, dwThreadId=0x8ac)) returned 1 [0258.263] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0258.263] WriteFile (in: hFile=0xec, lpBuffer=0x33b5d0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x33b5d0*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0258.263] CloseHandle (hObject=0xfc) returned 1 [0258.263] CloseHandle (hObject=0xf8) returned 1 [0258.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31b5a8 | out: hHeap=0x2e0000) returned 1 [0258.263] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0258.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5d0 | out: hHeap=0x2e0000) returned 1 [0258.263] lstrlenW (lpString="%comspec%") returned 9 [0258.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4388 | out: hHeap=0x2e0000) returned 1 [0258.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0258.263] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314a48 [0258.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x314a48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0258.264] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f47c0 [0258.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x2f47c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0258.264] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a60 [0258.264] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a60, Size=0x20) returned 0x2f4388 [0258.264] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4388, Size=0x40) returned 0x316a08 [0258.264] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0258.264] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xd0) returned 0x317c40 [0258.264] GetLogicalDrives () returned 0x4 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10014) returned 0x31b5a8 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a60 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a60, Size=0x20) returned 0x2f4388 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4388, Size=0x40) returned 0x316a98 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a98, Size=0x80) returned 0x33b5d0 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x3191b0 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x200) returned 0x3191b0 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x400) returned 0x3191b0 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x800) returned 0x3197c8 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3197c8, Size=0x1000) returned 0x32b5c8 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x33d5b8 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a60 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314b38 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4768 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x314b50 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x2f4778 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b68 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4778, Size=0x8) returned 0x2f4778 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b80 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4778, Size=0x10) returned 0x2f4730 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314b98 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314bb0 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4730, Size=0x20) returned 0x317ac8 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314bc8 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4778 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314be0 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314bf8 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x317ac8, Size=0x40) returned 0x3152f0 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c10 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c28 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c40 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x314c58 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314c70 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314c88 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x315338 [0258.265] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314ca0 [0258.265] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3152f0, Size=0x80) returned 0x3191b0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314cb8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314cd0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314ce8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x314d00 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3197e0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3197f8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319810 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4730 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319828 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319840 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319858 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319870 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319888 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3198a0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3198b8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3198d0 [0258.266] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x100) returned 0x3191b0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3198e8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319900 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319918 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x319930 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319948 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319960 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x2f4740 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319978 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319990 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199a8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x317ac8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199c0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199d8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x317ad8 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x3199f0 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a08 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319a20 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a38 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a50 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a68 [0258.266] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x319a80 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319a98 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x319ab0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ac8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ae0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319af8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b10 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x317ae8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b28 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b40 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b58 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b70 [0258.267] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x200) returned 0x3191b0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319b88 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x3152f0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ba0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319be0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319bf8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c10 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c28 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c40 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c58 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c70 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319c88 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319ca0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319cb8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319cd0 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ce8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d00 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d18 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d30 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d48 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319d60 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d78 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319d90 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319da8 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x315300 [0258.267] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319dc0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319dd8 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319df0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x319fe0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e08 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319e20 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e38 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e50 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e68 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e80 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319e98 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319eb0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319ec8 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319ee0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319ef8 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f10 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f28 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x319f40 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f58 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f70 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319f88 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x319fa0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c5e8 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c600 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c618 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x319ff0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a000 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c630 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c648 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c660 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c678 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c690 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c6a8 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c6c0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c6d8 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c6f0 [0258.268] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c708 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c720 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c738 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c750 [0258.269] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x400) returned 0x3191b0 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c768 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c780 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c798 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7b0 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7c8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c7e0 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c7f8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c810 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c828 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c840 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a010 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c858 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32c870 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c888 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8a0 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8b8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c8d0 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32c8e8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c900 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c918 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c930 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c948 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c960 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c978 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c990 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c9a8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a020 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32c9e8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca00 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca18 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca30 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca48 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca60 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca78 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ca90 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32caa8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32cac0 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cad8 [0258.269] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32caf0 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb08 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb20 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb38 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb50 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb68 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cb80 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cb98 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cbb0 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cbc8 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cbe0 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cbf8 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cc10 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cc28 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cc40 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cc58 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cc70 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cc88 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cca0 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ccb8 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ccd0 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cce8 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cd00 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cd18 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x32cd30 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x12) returned 0x315f18 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cd48 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cd60 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cd78 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cd90 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cda8 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cde8 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce00 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce18 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce30 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce48 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce60 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce78 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ce90 [0258.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cea8 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cec0 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32ced8 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cef0 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf08 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf20 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cf38 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cf50 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cf68 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cf80 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xe) returned 0x32cf98 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32cfb0 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a030 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cfc8 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a040 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cfe0 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32cff8 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d010 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d028 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d040 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d058 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d070 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d088 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d0a0 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d0b8 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d0d0 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d0e8 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x32d100 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d118 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x8) returned 0x31a050 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d130 [0258.271] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xa) returned 0x32d148 [0258.271] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3191b0, Size=0x800) returned 0x32d5d0 [0258.272] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b5c8 | out: hHeap=0x2e0000) returned 1 [0258.272] lstrlenW (lpString="") returned 0 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32df10 | out: hHeap=0x2e0000) returned 1 [0258.272] lstrlenW (lpString=".drweb") returned 6 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4768, Size=0x8) returned 0x2f4768 [0258.272] lstrlenW (lpString=".drweb") returned 6 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32df10 | out: hHeap=0x2e0000) returned 1 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df40, Size=0x20) returned 0x2f4388 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4388, Size=0x40) returned 0x316a98 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316a98, Size=0x80) returned 0x33b5d0 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0c0, Size=0x8) returned 0x31a0d0 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0d0, Size=0x10) returned 0x32df40 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df40, Size=0x20) returned 0x2f4360 [0258.272] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5d0 | out: hHeap=0x2e0000) returned 1 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df70, Size=0x20) returned 0x315948 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315948, Size=0x40) returned 0x316a98 [0258.272] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0258.272] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x316a98 | out: hHeap=0x2e0000) returned 1 [0258.272] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df70, Size=0x20) returned 0x315948 [0258.272] lstrlenW (lpString="Info.hta") returned 8 [0258.272] lstrlenW (lpString="Info.hta") returned 8 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315948 | out: hHeap=0x2e0000) returned 1 [0258.272] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34d5c0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe")) returned 0x34 [0258.272] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5c0 | out: hHeap=0x2e0000) returned 1 [0258.272] lstrlenW (lpString="expIorer32.exe") returned 14 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4360, Size=0x40) returned 0x316a98 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df70, Size=0x20) returned 0x2f4360 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df70, Size=0x20) returned 0x3158f8 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3158f8, Size=0x40) returned 0x316ae0 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316ae0, Size=0x80) returned 0x33b5d0 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x31a3c8 [0258.273] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.273] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a3c8 | out: hHeap=0x2e0000) returned 1 [0258.273] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x34d5c0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0258.273] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35d5c8 | out: hHeap=0x2e0000) returned 1 [0258.273] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5c0 | out: hHeap=0x2e0000) returned 1 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0d0, Size=0x8) returned 0x31a0c0 [0258.273] lstrlenW (lpString="%windir%;") returned 9 [0258.273] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4360 | out: hHeap=0x2e0000) returned 1 [0258.273] lstrlenW (lpString="C:\\Windows;") returned 11 [0258.273] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d5b8 | out: hHeap=0x2e0000) returned 1 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32df88, Size=0x20) returned 0x2f4360 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4360, Size=0x40) returned 0x316ae0 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316ae0, Size=0x80) returned 0x33b5d0 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x31a3c8 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a100, Size=0x8) returned 0x31a110 [0258.273] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a110, Size=0x10) returned 0x32dfd0 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32dfd0, Size=0x20) returned 0x2f4360 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0d0, Size=0x8) returned 0x31a110 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0e0, Size=0x8) returned 0x31a0d0 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a100, Size=0x8) returned 0x31a120 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a120, Size=0x10) returned 0x32e078 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e078, Size=0x20) returned 0x3158f8 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a110, Size=0x10) returned 0x32e078 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a0d0, Size=0x10) returned 0x32e0a8 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a110, Size=0x8) returned 0x31a100 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a130, Size=0x8) returned 0x31a140 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e078, Size=0x20) returned 0x315858 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e0a8, Size=0x20) returned 0x315970 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a150, Size=0x8) returned 0x31a160 [0258.274] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0258.274] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a3c8 | out: hHeap=0x2e0000) returned 1 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e120, Size=0x20) returned 0x315998 [0258.274] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x33d5b8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0258.274] lstrlenW (lpString="C:\\") returned 3 [0258.274] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0258.274] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33d5b8 | out: hHeap=0x2e0000) returned 1 [0258.274] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a190, Size=0x82) returned 0x32ba58 [0258.275] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a1b0, Size=0x100) returned 0x32bae8 [0258.275] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32bbf0, Size=0x104) returned 0x32bd10 [0258.275] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b6e0, Size=0x100) returned 0x32be20 [0258.275] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32ba58, Size=0x104) returned 0x32bf28 [0258.275] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32bae8, Size=0x200) returned 0x32c038 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a1a0 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32c038 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b670 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b768 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e180 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b7f0 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e1b0 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bf28 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e198 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bd10 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b688 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bc80 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b6a0 | out: hHeap=0x2e0000) returned 1 [0258.276] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e198, Size=0x20) returned 0x3159c0 [0258.276] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159c0, Size=0x40) returned 0x316ae0 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a170 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e120 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b5c8 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e150 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32be20 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e138 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a180 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32e168 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a4a0 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315ff8 | out: hHeap=0x2e0000) returned 1 [0258.276] lstrlenW (lpString="%systemdrive%") returned 13 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315998 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5d0 | out: hHeap=0x2e0000) returned 1 [0258.276] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a150 | out: hHeap=0x2e0000) returned 1 [0258.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x31b5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e168, Size=0x20) returned 0x3159c0 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159c0, Size=0x40) returned 0x316b28 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316b28, Size=0x80) returned 0x33b5d0 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x32ba58 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32ba58, Size=0x200) returned 0x32ba58 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32ba58, Size=0x400) returned 0x32ba58 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32ba58, Size=0x800) returned 0x32ba58 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32ba58, Size=0x1000) returned 0x3301e0 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a150, Size=0x8) returned 0x31a170 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a170, Size=0x10) returned 0x32e180 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32e180, Size=0x20) returned 0x3159c0 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159c0, Size=0x40) returned 0x316b28 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316b28, Size=0x80) returned 0x33b5d0 [0258.277] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x331200 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x331200, Size=0x200) returned 0x32be58 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32be58, Size=0x400) returned 0x3331e8 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3331e8, Size=0x800) returned 0x3341f0 [0258.278] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0258.278] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3301e0 | out: hHeap=0x2e0000) returned 1 [0258.278] lstrlenW (lpString="") returned 0 [0258.278] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x335070 | out: hHeap=0x2e0000) returned 1 [0258.278] lstrlenW (lpString=".drweb") returned 6 [0258.278] lstrlenW (lpString=".drweb") returned 6 [0258.278] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x335070 | out: hHeap=0x2e0000) returned 1 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350a0, Size=0x20) returned 0x3159c0 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3159c0, Size=0x40) returned 0x316b28 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316b28, Size=0x80) returned 0x33b5d0 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a2f0, Size=0x8) returned 0x31a300 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a300, Size=0x10) returned 0x3350a0 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350a0, Size=0x20) returned 0x315a10 [0258.278] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0258.278] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5d0 | out: hHeap=0x2e0000) returned 1 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350d0, Size=0x20) returned 0x315a38 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315a38, Size=0x40) returned 0x316b28 [0258.278] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0258.278] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0258.278] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x316b28 | out: hHeap=0x2e0000) returned 1 [0258.278] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350d0, Size=0x20) returned 0x315a38 [0258.278] lstrlenW (lpString="Info.hta") returned 8 [0258.278] lstrlenW (lpString="Info.hta") returned 8 [0258.278] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315a38 | out: hHeap=0x2e0000) returned 1 [0258.279] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35d5e0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\expIorer32.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\expiorer32.exe")) returned 0x34 [0258.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35d5e0 | out: hHeap=0x2e0000) returned 1 [0258.279] lstrlenW (lpString="expIorer32.exe") returned 14 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315a10, Size=0x40) returned 0x316b28 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350d0, Size=0x20) returned 0x315a10 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350d0, Size=0x20) returned 0x315a60 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315a60, Size=0x40) returned 0x316b70 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316b70, Size=0x80) returned 0x33b5d0 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x331200 [0258.279] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0258.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x331200 | out: hHeap=0x2e0000) returned 1 [0258.279] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x35d5e0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0258.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x36d5e8 | out: hHeap=0x2e0000) returned 1 [0258.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35d5e0 | out: hHeap=0x2e0000) returned 1 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a300, Size=0x8) returned 0x31a2f0 [0258.279] lstrlenW (lpString="%windir%;") returned 9 [0258.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315a10 | out: hHeap=0x2e0000) returned 1 [0258.279] lstrlenW (lpString="C:\\Windows;") returned 11 [0258.279] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5d8 | out: hHeap=0x2e0000) returned 1 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3350e8, Size=0x20) returned 0x315a10 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315a10, Size=0x40) returned 0x316b70 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316b70, Size=0x80) returned 0x33b5d0 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x331200 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a330, Size=0x8) returned 0x31a340 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a340, Size=0x10) returned 0x335130 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x335130, Size=0x20) returned 0x315a10 [0258.279] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a300, Size=0x8) returned 0x31a340 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a310, Size=0x8) returned 0x31a300 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a330, Size=0x8) returned 0x31a350 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a350, Size=0x10) returned 0x3351d8 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3351d8, Size=0x20) returned 0x315a60 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a340, Size=0x10) returned 0x3351d8 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a300, Size=0x10) returned 0x330210 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a340, Size=0x8) returned 0x31a330 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a360, Size=0x8) returned 0x31a370 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3351d8, Size=0x20) returned 0x315a88 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330210, Size=0x20) returned 0x315ab0 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a380, Size=0x8) returned 0x31a390 [0258.280] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0258.280] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x331200 | out: hHeap=0x2e0000) returned 1 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3302a0, Size=0x20) returned 0x315b00 [0258.280] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x34d5d8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0258.280] lstrlenW (lpString="C:\\") returned 3 [0258.280] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0258.280] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34d5d8 | out: hHeap=0x2e0000) returned 1 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x333200, Size=0x82) returned 0x32c538 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x333220, Size=0x100) returned 0x331200 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32be58, Size=0x104) returned 0x3309e0 [0258.280] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b7f0, Size=0x100) returned 0x331308 [0258.281] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x32c538, Size=0x104) returned 0x330af0 [0258.281] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x331200, Size=0x200) returned 0x335210 [0258.281] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x333210 | out: hHeap=0x2e0000) returned 1 [0258.281] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x335210 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330348 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b768 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330300 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b6e0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330330 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330af0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330318 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3309e0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330360 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32bee8 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x330378 | out: hHeap=0x2e0000) returned 1 [0258.282] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330378, Size=0x20) returned 0x315b28 [0258.282] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315b28, Size=0x40) returned 0x316b70 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a3a0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3302a0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x32b5c8 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3302d0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x331308 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3302b8 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a3b0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3302e8 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x317ee0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3160f8 | out: hHeap=0x2e0000) returned 1 [0258.282] lstrlenW (lpString="%systemdrive%") returned 13 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x315b00 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x33b5d0 | out: hHeap=0x2e0000) returned 1 [0258.282] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x31a380 | out: hHeap=0x2e0000) returned 1 [0258.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x33d5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0258.283] WaitForMultipleObjects (nCount=0x2, lpHandles=0x317c40*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x88c Thread: id = 4 os_tid = 0x714 [0258.502] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3302e8 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3302e8, Size=0x20) returned 0x315b28 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315b28, Size=0x40) returned 0x316bb8 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316bb8, Size=0x80) returned 0x33b5d0 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x331308 [0258.502] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3302e8 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3302e8, Size=0x20) returned 0x315b28 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315b28, Size=0x40) returned 0x316bb8 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x316bb8, Size=0x80) returned 0x33b5d0 [0258.502] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x33b5d0, Size=0x100) returned 0x331200 [0258.502] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3302e8 [0258.502] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a380 [0258.502] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3302b8 [0258.503] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a380, Size=0x8) returned 0x31a3b0 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x316118 [0258.503] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a3b0, Size=0x10) returned 0x3302d0 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x316138 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x315b28 [0258.503] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3302d0, Size=0x20) returned 0x315b50 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1c) returned 0x315b78 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x16) returned 0x316158 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1a) returned 0x315ba0 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xc) returned 0x3302d0 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x4) returned 0x31a3b0 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40) returned 0x316bb8 [0258.503] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a3b0, Size=0x8) returned 0x31a380 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x3c) returned 0x316c00 [0258.503] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x31a380, Size=0x10) returned 0x3302a0 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x14) returned 0x316178 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x18) returned 0x316198 [0258.503] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3302a0, Size=0x20) returned 0x315bc8 [0258.503] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x317ee0 [0258.504] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0258.504] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x331308 | out: hHeap=0x2e0000) returned 1 [0258.504] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0258.504] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x331200 | out: hHeap=0x2e0000) returned 1 [0258.504] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x315c68 [0258.504] EnumServicesStatusExW (in: hSCManager=0x315c68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0258.504] GetLastError () returned 0xea [0258.505] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x34e618 [0258.505] EnumServicesStatusExW (in: hSCManager=0x315c68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x34e618, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x34e618, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0258.505] CloseServiceHandle (hSCObject=0x315c68) returned 1 [0258.506] lstrlenW (lpString="Appinfo") returned 7 [0258.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0258.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0258.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0258.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0258.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0258.506] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.506] lstrlenW (lpString="AudioSrv") returned 8 [0258.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0258.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0258.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0258.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0258.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0258.507] lstrlenW (lpString="BFE") returned 3 [0258.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.507] lstrlenW (lpString="CryptSvc") returned 8 [0258.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.507] lstrlenW (lpString="CscService") returned 10 [0258.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0258.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0258.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0258.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0258.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0258.508] lstrlenW (lpString="DcomLaunch") returned 10 [0258.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.508] lstrlenW (lpString="Dhcp") returned 4 [0258.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.508] lstrlenW (lpString="Dnscache") returned 8 [0258.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.509] lstrlenW (lpString="DPS") returned 3 [0258.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.509] lstrlenW (lpString="eventlog") returned 8 [0258.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0258.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0258.509] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0258.509] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0258.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0258.509] lstrlenW (lpString="EventSystem") returned 11 [0258.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.510] lstrlenW (lpString="FontCache") returned 9 [0258.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0258.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0258.510] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0258.510] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0258.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0258.510] lstrlenW (lpString="gpsvc") returned 5 [0258.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.510] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.510] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.510] lstrlenW (lpString="iphlpsvc") returned 8 [0258.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0258.511] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0258.511] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0258.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0258.511] lstrlenW (lpString="LanmanServer") returned 12 [0258.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0258.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0258.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0258.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0258.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0258.511] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.513] lstrlenW (lpString="lmhosts") returned 7 [0258.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.513] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.513] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.514] lstrlenW (lpString="MMCSS") returned 5 [0258.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0258.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0258.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0258.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0258.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0258.514] lstrlenW (lpString="MpsSvc") returned 6 [0258.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.514] lstrlenW (lpString="Netman") returned 6 [0258.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0258.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0258.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0258.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0258.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0258.515] lstrlenW (lpString="netprofm") returned 8 [0258.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0258.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0258.515] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0258.515] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0258.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0258.515] lstrlenW (lpString="NlaSvc") returned 6 [0258.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.515] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.515] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.515] lstrlenW (lpString="nsi") returned 3 [0258.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.515] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.515] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.516] lstrlenW (lpString="PcaSvc") returned 6 [0258.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.516] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.516] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.516] lstrlenW (lpString="PlugPlay") returned 8 [0258.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.516] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.516] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.516] lstrlenW (lpString="Power") returned 5 [0258.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.517] lstrlenW (lpString="ProfSvc") returned 7 [0258.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.517] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.517] lstrlenW (lpString="RpcSs") returned 5 [0258.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.517] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.517] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.519] lstrlenW (lpString="SamSs") returned 5 [0258.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.520] lstrlenW (lpString="Schedule") returned 8 [0258.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.520] lstrlenW (lpString="SENS") returned 4 [0258.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.520] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.520] lstrlenW (lpString="Spooler") returned 7 [0258.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.520] lstrlenW (lpString="sppsvc") returned 6 [0258.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0258.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0258.521] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0258.521] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0258.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0258.521] lstrlenW (lpString="SysMain") returned 7 [0258.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.521] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.521] lstrlenW (lpString="Themes") returned 6 [0258.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.521] lstrlenW (lpString="TrkWks") returned 6 [0258.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0258.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0258.521] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0258.521] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0258.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0258.521] lstrlenW (lpString="UxSms") returned 5 [0258.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0258.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0258.521] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0258.521] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0258.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0258.521] lstrlenW (lpString="WdiServiceHost") returned 14 [0258.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0258.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0258.522] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0258.522] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0258.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0258.522] lstrlenW (lpString="WdiSystemHost") returned 13 [0258.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0258.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0258.522] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0258.522] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0258.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0258.522] lstrlenW (lpString="WinDefend") returned 9 [0258.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0258.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0258.522] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0258.522] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0258.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0258.522] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0258.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0258.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0258.522] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0258.522] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0258.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0258.522] lstrlenW (lpString="Winmgmt") returned 7 [0258.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0258.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0258.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0258.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0258.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0258.522] lstrlenW (lpString="wscsvc") returned 6 [0258.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0258.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0258.523] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0258.523] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0258.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0258.523] lstrlenW (lpString="wuauserv") returned 8 [0258.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0258.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0258.523] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0258.523] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0258.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0258.523] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x34e618 | out: hHeap=0x2e0000) returned 1 [0258.523] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0258.525] Process32FirstW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.526] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.527] lstrlenW (lpString="System") returned 6 [0258.527] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0258.527] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0258.527] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0258.527] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0258.527] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0258.527] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0258.527] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0258.527] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.528] lstrlenW (lpString="smss.exe") returned 8 [0258.528] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0258.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0258.528] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0258.528] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0258.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0258.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0258.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0258.528] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.529] lstrlenW (lpString="csrss.exe") returned 9 [0258.529] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.530] lstrlenW (lpString="wininit.exe") returned 11 [0258.530] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.531] lstrlenW (lpString="csrss.exe") returned 9 [0258.531] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.531] lstrlenW (lpString="winlogon.exe") returned 12 [0258.531] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.532] lstrlenW (lpString="services.exe") returned 12 [0258.532] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.533] lstrlenW (lpString="lsass.exe") returned 9 [0258.533] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.534] lstrlenW (lpString="lsm.exe") returned 7 [0258.534] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.534] lstrlenW (lpString="svchost.exe") returned 11 [0258.534] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.535] lstrlenW (lpString="svchost.exe") returned 11 [0258.535] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.536] lstrlenW (lpString="svchost.exe") returned 11 [0258.536] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.537] lstrlenW (lpString="svchost.exe") returned 11 [0258.537] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.537] lstrlenW (lpString="svchost.exe") returned 11 [0258.537] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.538] lstrlenW (lpString="audiodg.exe") returned 11 [0258.538] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.539] lstrlenW (lpString="svchost.exe") returned 11 [0258.539] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.540] lstrlenW (lpString="svchost.exe") returned 11 [0258.540] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.540] lstrlenW (lpString="dwm.exe") returned 7 [0258.540] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.541] lstrlenW (lpString="explorer.exe") returned 12 [0258.541] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.542] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.542] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.553] lstrlenW (lpString="taskhost.exe") returned 12 [0258.553] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.554] lstrlenW (lpString="svchost.exe") returned 11 [0258.554] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0258.555] lstrlenW (lpString="taskeng.exe") returned 11 [0258.555] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.556] lstrlenW (lpString="svchost.exe") returned 11 [0258.556] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.556] lstrlenW (lpString="taskhost.exe") returned 12 [0258.556] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0258.557] lstrlenW (lpString="sppsvc.exe") returned 10 [0258.557] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.558] lstrlenW (lpString="svchost.exe") returned 11 [0258.558] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0258.561] lstrlenW (lpString="push nutrition.exe") returned 18 [0259.351] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0259.352] lstrlenW (lpString="procedures.exe") returned 14 [0259.352] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0259.353] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0259.353] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0259.354] lstrlenW (lpString="scanner-discover.exe") returned 20 [0259.354] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0259.355] lstrlenW (lpString="regression healthcare.exe") returned 25 [0259.355] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0259.356] lstrlenW (lpString="apr_zinc.exe") returned 12 [0259.356] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0259.357] lstrlenW (lpString="computer.exe") returned 12 [0259.357] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0259.357] lstrlenW (lpString="importanceweekend.exe") returned 21 [0259.357] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0259.359] lstrlenW (lpString="warm_absolute.exe") returned 17 [0259.359] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0259.360] lstrlenW (lpString="funding_editing.exe") returned 19 [0259.360] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0259.361] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0259.361] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0259.361] lstrlenW (lpString="friend.exe") returned 10 [0259.361] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0259.362] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0259.362] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0259.363] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0259.363] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0259.364] lstrlenW (lpString="individually_antiques.exe") returned 25 [0259.364] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0259.364] lstrlenW (lpString="embedded.exe") returned 12 [0259.365] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0259.365] lstrlenW (lpString="usually.exe") returned 11 [0259.365] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0259.423] lstrlenW (lpString="bills.exe") returned 9 [0259.423] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0259.423] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0259.423] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0259.424] lstrlenW (lpString="terminal.exe") returned 12 [0259.424] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0259.425] lstrlenW (lpString="ol_refers.exe") returned 13 [0259.425] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0259.425] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0259.425] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0259.426] lstrlenW (lpString="riding analyst.exe") returned 18 [0259.426] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0259.426] lstrlenW (lpString="robots.exe") returned 10 [0259.426] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0259.427] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0259.427] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0259.428] lstrlenW (lpString="dllhost.exe") returned 11 [0259.428] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0259.428] lstrlenW (lpString="dllhost.exe") returned 11 [0259.428] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0259.429] lstrlenW (lpString="expIorer32.exe") returned 14 [0259.429] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0259.429] lstrlenW (lpString="cmd.exe") returned 7 [0259.429] Process32NextW (in: hSnapshot=0x118, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0259.430] CloseHandle (hObject=0x118) returned 1 [0259.430] Sleep (dwMilliseconds=0x1f4) [0261.294] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fc18 [0261.524] EnumServicesStatusExW (in: hSCManager=0x35fc18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0261.524] GetLastError () returned 0xea [0261.524] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x3ee0850 [0261.525] EnumServicesStatusExW (in: hSCManager=0x35fc18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ee0850, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ee0850, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0261.525] CloseServiceHandle (hSCObject=0x35fc18) returned 1 [0261.525] lstrlenW (lpString="Appinfo") returned 7 [0261.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0261.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0261.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0261.526] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.526] lstrlenW (lpString="AudioSrv") returned 8 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0261.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0261.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0261.526] lstrlenW (lpString="BFE") returned 3 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.526] lstrlenW (lpString="CryptSvc") returned 8 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.527] lstrlenW (lpString="CscService") returned 10 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0261.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0261.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0261.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0261.527] lstrlenW (lpString="DcomLaunch") returned 10 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.527] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.527] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.527] lstrlenW (lpString="Dhcp") returned 4 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.527] lstrlenW (lpString="Dnscache") returned 8 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.527] lstrlenW (lpString="DPS") returned 3 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.528] lstrlenW (lpString="eventlog") returned 8 [0261.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0261.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0261.528] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0261.528] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0261.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0261.528] lstrlenW (lpString="EventSystem") returned 11 [0261.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.528] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.528] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.528] lstrlenW (lpString="FontCache") returned 9 [0261.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0261.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0261.528] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0261.528] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0261.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0261.528] lstrlenW (lpString="gpsvc") returned 5 [0261.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.529] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.529] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.529] lstrlenW (lpString="iphlpsvc") returned 8 [0261.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.529] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.529] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.529] lstrlenW (lpString="LanmanServer") returned 12 [0261.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.529] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.530] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.530] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.530] lstrlenW (lpString="lmhosts") returned 7 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.530] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.530] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.530] lstrlenW (lpString="MMCSS") returned 5 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0261.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0261.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0261.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0261.530] lstrlenW (lpString="MpsSvc") returned 6 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.530] lstrlenW (lpString="Netman") returned 6 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0261.531] lstrlenW (lpString="netprofm") returned 8 [0261.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.531] lstrlenW (lpString="NlaSvc") returned 6 [0261.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.531] lstrlenW (lpString="nsi") returned 3 [0261.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.531] lstrlenW (lpString="PcaSvc") returned 6 [0261.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.532] lstrlenW (lpString="PlugPlay") returned 8 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.532] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.532] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.532] lstrlenW (lpString="Power") returned 5 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.532] lstrlenW (lpString="ProfSvc") returned 7 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.532] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.532] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.532] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.532] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.532] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.532] lstrlenW (lpString="RpcSs") returned 5 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.533] lstrlenW (lpString="SamSs") returned 5 [0261.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.533] lstrlenW (lpString="Schedule") returned 8 [0261.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.533] lstrlenW (lpString="SENS") returned 4 [0261.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.533] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.534] lstrlenW (lpString="Spooler") returned 7 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.534] lstrlenW (lpString="sppsvc") returned 6 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0261.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0261.534] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0261.534] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0261.534] lstrlenW (lpString="SysMain") returned 7 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.534] lstrlenW (lpString="Themes") returned 6 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.534] lstrlenW (lpString="TrkWks") returned 6 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0261.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0261.535] lstrlenW (lpString="UxSms") returned 5 [0261.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0261.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0261.535] lstrlenW (lpString="WdiServiceHost") returned 14 [0261.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0261.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0261.535] lstrlenW (lpString="WdiSystemHost") returned 13 [0261.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0261.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0261.535] lstrlenW (lpString="WinDefend") returned 9 [0261.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0261.536] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0261.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0261.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0261.536] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0261.536] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0261.536] lstrlenW (lpString="Winmgmt") returned 7 [0261.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0261.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0261.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0261.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0261.536] lstrlenW (lpString="wscsvc") returned 6 [0261.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0261.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0261.536] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0261.536] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0261.536] lstrlenW (lpString="wuauserv") returned 8 [0261.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0261.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0261.536] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0261.536] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0261.536] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ee0850 | out: hHeap=0x2e0000) returned 1 [0261.537] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0261.540] Process32FirstW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.541] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.541] lstrlenW (lpString="System") returned 6 [0261.541] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0261.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0261.541] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0261.542] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0261.542] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0261.542] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0261.542] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0261.542] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.543] lstrlenW (lpString="smss.exe") returned 8 [0261.543] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0261.543] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0261.543] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0261.543] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0261.543] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0261.543] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0261.543] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0261.543] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.544] lstrlenW (lpString="csrss.exe") returned 9 [0261.544] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.545] lstrlenW (lpString="wininit.exe") returned 11 [0261.545] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.546] lstrlenW (lpString="csrss.exe") returned 9 [0261.546] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.547] lstrlenW (lpString="winlogon.exe") returned 12 [0261.547] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.548] lstrlenW (lpString="services.exe") returned 12 [0261.548] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.548] lstrlenW (lpString="lsass.exe") returned 9 [0261.549] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0261.549] lstrlenW (lpString="lsm.exe") returned 7 [0261.549] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.550] lstrlenW (lpString="svchost.exe") returned 11 [0261.550] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.551] lstrlenW (lpString="svchost.exe") returned 11 [0261.551] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.552] lstrlenW (lpString="svchost.exe") returned 11 [0261.552] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.555] lstrlenW (lpString="svchost.exe") returned 11 [0261.555] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.556] lstrlenW (lpString="svchost.exe") returned 11 [0261.556] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.557] lstrlenW (lpString="audiodg.exe") returned 11 [0261.557] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.558] lstrlenW (lpString="svchost.exe") returned 11 [0261.558] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.559] lstrlenW (lpString="svchost.exe") returned 11 [0261.559] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.560] lstrlenW (lpString="dwm.exe") returned 7 [0261.560] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.561] lstrlenW (lpString="explorer.exe") returned 12 [0261.561] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.562] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.562] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.563] lstrlenW (lpString="taskhost.exe") returned 12 [0261.563] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.564] lstrlenW (lpString="svchost.exe") returned 11 [0261.564] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0261.565] lstrlenW (lpString="taskeng.exe") returned 11 [0261.565] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.566] lstrlenW (lpString="svchost.exe") returned 11 [0261.566] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.567] lstrlenW (lpString="taskhost.exe") returned 12 [0261.567] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0261.568] lstrlenW (lpString="sppsvc.exe") returned 10 [0261.568] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.694] lstrlenW (lpString="svchost.exe") returned 11 [0261.694] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0261.695] lstrlenW (lpString="push nutrition.exe") returned 18 [0261.695] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0261.696] lstrlenW (lpString="procedures.exe") returned 14 [0261.696] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0261.697] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0261.697] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0261.698] lstrlenW (lpString="scanner-discover.exe") returned 20 [0261.698] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0261.699] lstrlenW (lpString="regression healthcare.exe") returned 25 [0261.699] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0261.700] lstrlenW (lpString="apr_zinc.exe") returned 12 [0261.700] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0261.701] lstrlenW (lpString="computer.exe") returned 12 [0261.701] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0261.702] lstrlenW (lpString="importanceweekend.exe") returned 21 [0261.702] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0261.703] lstrlenW (lpString="warm_absolute.exe") returned 17 [0261.703] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0261.704] lstrlenW (lpString="funding_editing.exe") returned 19 [0261.704] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0261.705] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0261.705] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0261.705] lstrlenW (lpString="friend.exe") returned 10 [0261.706] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0261.706] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0261.706] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0261.707] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0261.707] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0261.708] lstrlenW (lpString="individually_antiques.exe") returned 25 [0261.708] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0261.709] lstrlenW (lpString="embedded.exe") returned 12 [0261.709] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0261.710] lstrlenW (lpString="usually.exe") returned 11 [0261.710] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0261.711] lstrlenW (lpString="bills.exe") returned 9 [0261.711] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0261.712] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0261.712] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0261.713] lstrlenW (lpString="terminal.exe") returned 12 [0261.713] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0261.714] lstrlenW (lpString="ol_refers.exe") returned 13 [0261.714] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0261.715] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0261.715] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0261.716] lstrlenW (lpString="riding analyst.exe") returned 18 [0261.716] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0261.717] lstrlenW (lpString="robots.exe") returned 10 [0261.717] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0261.718] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0261.718] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0261.718] lstrlenW (lpString="dllhost.exe") returned 11 [0261.718] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0261.719] lstrlenW (lpString="dllhost.exe") returned 11 [0261.719] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0261.720] lstrlenW (lpString="expIorer32.exe") returned 14 [0261.720] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0261.721] lstrlenW (lpString="cmd.exe") returned 7 [0261.721] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0261.722] lstrlenW (lpString="conhost.exe") returned 11 [0261.722] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0261.723] lstrlenW (lpString="mode.com") returned 8 [0261.723] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0261.724] CloseHandle (hObject=0x174) returned 1 [0261.724] Sleep (dwMilliseconds=0x1f4) [0262.499] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fc18 [0262.500] EnumServicesStatusExW (in: hSCManager=0x35fc18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0262.500] GetLastError () returned 0xea [0262.500] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x39746f0 [0262.500] EnumServicesStatusExW (in: hSCManager=0x35fc18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39746f0, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39746f0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0262.501] CloseServiceHandle (hSCObject=0x35fc18) returned 1 [0262.501] lstrlenW (lpString="Appinfo") returned 7 [0262.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0262.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0262.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0262.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0262.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0262.501] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0262.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.501] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0262.501] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0262.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0262.501] lstrlenW (lpString="AudioSrv") returned 8 [0262.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0262.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0262.502] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0262.502] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0262.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0262.502] lstrlenW (lpString="BFE") returned 3 [0262.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0262.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0262.502] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0262.502] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0262.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0262.502] lstrlenW (lpString="CryptSvc") returned 8 [0262.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0262.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0262.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0262.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0262.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0262.502] lstrlenW (lpString="CscService") returned 10 [0262.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0262.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0262.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0262.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0262.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0262.502] lstrlenW (lpString="DcomLaunch") returned 10 [0262.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0262.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0262.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0262.503] lstrlenW (lpString="Dhcp") returned 4 [0262.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0262.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0262.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0262.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0262.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0262.503] lstrlenW (lpString="Dnscache") returned 8 [0262.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0262.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0262.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0262.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0262.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0262.503] lstrlenW (lpString="DPS") returned 3 [0262.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0262.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0262.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0262.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0262.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0262.503] lstrlenW (lpString="eventlog") returned 8 [0262.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0262.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0262.503] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0262.503] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0262.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0262.503] lstrlenW (lpString="EventSystem") returned 11 [0262.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0262.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0262.504] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0262.504] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0262.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0262.504] lstrlenW (lpString="FontCache") returned 9 [0262.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0262.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0262.504] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0262.504] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0262.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0262.504] lstrlenW (lpString="gpsvc") returned 5 [0262.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0262.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0262.504] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0262.504] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0262.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0262.504] lstrlenW (lpString="iphlpsvc") returned 8 [0262.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.504] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0262.504] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0262.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0262.504] lstrlenW (lpString="LanmanServer") returned 12 [0262.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0262.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0262.505] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0262.505] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0262.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0262.505] lstrlenW (lpString="LanmanWorkstation") returned 17 [0262.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.505] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0262.505] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0262.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0262.505] lstrlenW (lpString="lmhosts") returned 7 [0262.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0262.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0262.505] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0262.505] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0262.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0262.505] lstrlenW (lpString="MMCSS") returned 5 [0262.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0262.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0262.505] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0262.505] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0262.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0262.506] lstrlenW (lpString="MpsSvc") returned 6 [0262.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0262.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0262.506] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0262.506] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0262.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0262.506] lstrlenW (lpString="Netman") returned 6 [0262.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0262.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0262.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0262.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0262.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0262.506] lstrlenW (lpString="netprofm") returned 8 [0262.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0262.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0262.506] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0262.506] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0262.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0262.506] lstrlenW (lpString="NlaSvc") returned 6 [0262.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.506] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.506] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.506] lstrlenW (lpString="nsi") returned 3 [0262.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.507] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.507] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.507] lstrlenW (lpString="PcaSvc") returned 6 [0262.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.507] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.507] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.507] lstrlenW (lpString="PlugPlay") returned 8 [0262.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.507] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.507] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.507] lstrlenW (lpString="Power") returned 5 [0262.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.507] lstrlenW (lpString="ProfSvc") returned 7 [0262.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.507] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.507] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.508] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.508] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.508] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.508] lstrlenW (lpString="RpcSs") returned 5 [0262.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.508] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.508] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.508] lstrlenW (lpString="SamSs") returned 5 [0262.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.508] lstrlenW (lpString="Schedule") returned 8 [0262.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.508] lstrlenW (lpString="SENS") returned 4 [0262.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.509] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.509] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.509] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.509] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.509] lstrlenW (lpString="Spooler") returned 7 [0262.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.509] lstrlenW (lpString="sppsvc") returned 6 [0262.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0262.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0262.509] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0262.509] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0262.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0262.509] lstrlenW (lpString="SysMain") returned 7 [0262.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.509] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0262.510] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0262.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0262.510] lstrlenW (lpString="Themes") returned 6 [0262.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0262.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0262.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0262.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0262.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0262.510] lstrlenW (lpString="TrkWks") returned 6 [0262.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0262.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0262.510] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0262.510] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0262.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0262.510] lstrlenW (lpString="UxSms") returned 5 [0262.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0262.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0262.510] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0262.510] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0262.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0262.510] lstrlenW (lpString="WdiServiceHost") returned 14 [0262.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0262.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0262.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0262.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0262.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0262.511] lstrlenW (lpString="WdiSystemHost") returned 13 [0262.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0262.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0262.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0262.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0262.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0262.511] lstrlenW (lpString="WinDefend") returned 9 [0262.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0262.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0262.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0262.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0262.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0262.511] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0262.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0262.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0262.511] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0262.511] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0262.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0262.511] lstrlenW (lpString="Winmgmt") returned 7 [0262.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0262.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0262.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0262.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0262.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0262.511] lstrlenW (lpString="wscsvc") returned 6 [0262.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0262.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0262.512] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0262.512] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0262.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0262.512] lstrlenW (lpString="wuauserv") returned 8 [0262.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0262.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0262.512] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0262.512] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0262.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0262.512] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39746f0 | out: hHeap=0x2e0000) returned 1 [0262.512] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0262.515] Process32FirstW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.516] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.516] lstrlenW (lpString="System") returned 6 [0262.516] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0262.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0262.517] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0262.517] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0262.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0262.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0262.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0262.517] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.518] lstrlenW (lpString="smss.exe") returned 8 [0262.518] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0262.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0262.518] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0262.518] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0262.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0262.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0262.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0262.518] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.529] lstrlenW (lpString="csrss.exe") returned 9 [0262.529] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.530] lstrlenW (lpString="wininit.exe") returned 11 [0262.530] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.532] lstrlenW (lpString="csrss.exe") returned 9 [0262.532] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.534] lstrlenW (lpString="winlogon.exe") returned 12 [0262.534] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.535] lstrlenW (lpString="services.exe") returned 12 [0262.535] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.538] lstrlenW (lpString="lsass.exe") returned 9 [0262.538] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0262.538] lstrlenW (lpString="lsm.exe") returned 7 [0262.539] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.540] lstrlenW (lpString="svchost.exe") returned 11 [0262.540] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.542] lstrlenW (lpString="svchost.exe") returned 11 [0262.542] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.543] lstrlenW (lpString="svchost.exe") returned 11 [0262.543] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.544] lstrlenW (lpString="svchost.exe") returned 11 [0262.544] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.545] lstrlenW (lpString="svchost.exe") returned 11 [0262.545] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.547] lstrlenW (lpString="audiodg.exe") returned 11 [0262.547] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.548] lstrlenW (lpString="svchost.exe") returned 11 [0262.548] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.550] lstrlenW (lpString="svchost.exe") returned 11 [0262.550] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.754] lstrlenW (lpString="dwm.exe") returned 7 [0262.754] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.755] lstrlenW (lpString="explorer.exe") returned 12 [0262.755] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.756] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.756] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.757] lstrlenW (lpString="taskhost.exe") returned 12 [0262.757] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.757] lstrlenW (lpString="svchost.exe") returned 11 [0262.758] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0262.758] lstrlenW (lpString="taskeng.exe") returned 11 [0262.758] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.759] lstrlenW (lpString="svchost.exe") returned 11 [0262.759] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.760] lstrlenW (lpString="taskhost.exe") returned 12 [0262.760] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0262.761] lstrlenW (lpString="sppsvc.exe") returned 10 [0262.761] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.762] lstrlenW (lpString="svchost.exe") returned 11 [0262.762] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0262.763] lstrlenW (lpString="push nutrition.exe") returned 18 [0262.763] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0262.767] lstrlenW (lpString="procedures.exe") returned 14 [0262.767] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0262.768] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0262.768] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0262.769] lstrlenW (lpString="scanner-discover.exe") returned 20 [0262.769] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0262.770] lstrlenW (lpString="regression healthcare.exe") returned 25 [0262.770] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0262.771] lstrlenW (lpString="apr_zinc.exe") returned 12 [0262.771] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0262.772] lstrlenW (lpString="computer.exe") returned 12 [0262.772] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0262.773] lstrlenW (lpString="importanceweekend.exe") returned 21 [0262.773] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0262.774] lstrlenW (lpString="warm_absolute.exe") returned 17 [0262.774] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0262.774] lstrlenW (lpString="funding_editing.exe") returned 19 [0262.774] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0262.775] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0262.775] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0262.776] lstrlenW (lpString="friend.exe") returned 10 [0262.776] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0262.777] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0262.777] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0262.778] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0262.778] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0262.779] lstrlenW (lpString="individually_antiques.exe") returned 25 [0262.779] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0262.779] lstrlenW (lpString="embedded.exe") returned 12 [0262.780] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0262.780] lstrlenW (lpString="usually.exe") returned 11 [0262.780] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0262.781] lstrlenW (lpString="bills.exe") returned 9 [0262.781] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0262.784] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0262.784] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0262.785] lstrlenW (lpString="terminal.exe") returned 12 [0262.785] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0262.786] lstrlenW (lpString="ol_refers.exe") returned 13 [0262.786] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0262.787] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0262.787] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0262.799] lstrlenW (lpString="riding analyst.exe") returned 18 [0262.799] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0262.799] lstrlenW (lpString="robots.exe") returned 10 [0262.799] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0262.800] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0262.800] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0262.802] lstrlenW (lpString="dllhost.exe") returned 11 [0262.802] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0263.078] lstrlenW (lpString="dllhost.exe") returned 11 [0263.078] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0263.079] lstrlenW (lpString="expIorer32.exe") returned 14 [0263.079] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0263.080] lstrlenW (lpString="cmd.exe") returned 7 [0263.080] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0263.081] lstrlenW (lpString="conhost.exe") returned 11 [0263.081] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0263.082] lstrlenW (lpString="mode.com") returned 8 [0263.082] Process32NextW (in: hSnapshot=0x16c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0263.083] CloseHandle (hObject=0x16c) returned 1 [0263.083] Sleep (dwMilliseconds=0x1f4) [0263.647] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fc68 [0263.647] EnumServicesStatusExW (in: hSCManager=0x35fc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0263.648] GetLastError () returned 0xea [0263.648] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x397a740 [0263.648] EnumServicesStatusExW (in: hSCManager=0x35fc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x397a740, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x397a740, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0263.648] CloseServiceHandle (hSCObject=0x35fc68) returned 1 [0263.648] lstrlenW (lpString="Appinfo") returned 7 [0263.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0263.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0263.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0263.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0263.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0263.649] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.649] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.649] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.649] lstrlenW (lpString="AudioSrv") returned 8 [0263.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.649] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.649] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.649] lstrlenW (lpString="BFE") returned 3 [0263.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.649] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.649] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.649] lstrlenW (lpString="CryptSvc") returned 8 [0263.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.649] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.649] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.649] lstrlenW (lpString="CscService") returned 10 [0263.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.649] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.649] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.649] lstrlenW (lpString="DcomLaunch") returned 10 [0263.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.650] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.650] lstrlenW (lpString="Dhcp") returned 4 [0263.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.650] lstrlenW (lpString="Dnscache") returned 8 [0263.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.650] lstrlenW (lpString="DPS") returned 3 [0263.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.650] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.650] lstrlenW (lpString="eventlog") returned 8 [0263.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.650] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.650] lstrlenW (lpString="EventSystem") returned 11 [0263.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.650] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.650] lstrlenW (lpString="FontCache") returned 9 [0263.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0263.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0263.650] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0263.651] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0263.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0263.651] lstrlenW (lpString="gpsvc") returned 5 [0263.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.651] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.651] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.651] lstrlenW (lpString="iphlpsvc") returned 8 [0263.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.651] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0263.651] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0263.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0263.651] lstrlenW (lpString="LanmanServer") returned 12 [0263.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0263.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0263.651] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0263.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0263.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0263.651] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.651] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.651] lstrlenW (lpString="lmhosts") returned 7 [0263.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.651] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.651] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.651] lstrlenW (lpString="MMCSS") returned 5 [0263.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.652] lstrlenW (lpString="MpsSvc") returned 6 [0263.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.652] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.652] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.652] lstrlenW (lpString="Netman") returned 6 [0263.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0263.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0263.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0263.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0263.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0263.652] lstrlenW (lpString="netprofm") returned 8 [0263.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0263.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0263.652] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0263.652] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0263.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0263.652] lstrlenW (lpString="NlaSvc") returned 6 [0263.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.652] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.652] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.652] lstrlenW (lpString="nsi") returned 3 [0263.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.652] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.652] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.652] lstrlenW (lpString="PcaSvc") returned 6 [0263.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.653] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.653] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.653] lstrlenW (lpString="PlugPlay") returned 8 [0263.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.653] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.653] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.653] lstrlenW (lpString="Power") returned 5 [0263.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.653] lstrlenW (lpString="ProfSvc") returned 7 [0263.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.653] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.653] lstrlenW (lpString="RpcSs") returned 5 [0263.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.654] lstrlenW (lpString="SamSs") returned 5 [0263.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.654] lstrlenW (lpString="Schedule") returned 8 [0263.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.654] lstrlenW (lpString="SENS") returned 4 [0263.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.654] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.654] lstrlenW (lpString="Spooler") returned 7 [0263.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.654] lstrlenW (lpString="sppsvc") returned 6 [0263.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0263.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0263.655] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0263.655] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0263.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0263.655] lstrlenW (lpString="SysMain") returned 7 [0263.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.655] lstrlenW (lpString="Themes") returned 6 [0263.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.655] lstrlenW (lpString="TrkWks") returned 6 [0263.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0263.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0263.655] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0263.655] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0263.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0263.655] lstrlenW (lpString="UxSms") returned 5 [0263.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.655] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.655] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.655] lstrlenW (lpString="WdiServiceHost") returned 14 [0263.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0263.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0263.655] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0263.655] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0263.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0263.656] lstrlenW (lpString="WdiSystemHost") returned 13 [0263.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0263.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0263.656] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0263.656] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0263.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0263.656] lstrlenW (lpString="WinDefend") returned 9 [0263.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0263.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0263.656] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0263.656] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0263.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0263.656] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0263.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0263.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0263.656] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0263.656] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0263.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0263.656] lstrlenW (lpString="Winmgmt") returned 7 [0263.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0263.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0263.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0263.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0263.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0263.656] lstrlenW (lpString="wscsvc") returned 6 [0263.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0263.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0263.656] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0263.656] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0263.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0263.656] lstrlenW (lpString="wuauserv") returned 8 [0263.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0263.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0263.657] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0263.657] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0263.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0263.657] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x397a740 | out: hHeap=0x2e0000) returned 1 [0263.657] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0263.659] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.659] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.660] lstrlenW (lpString="System") returned 6 [0263.660] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.660] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.660] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.660] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.660] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.661] lstrlenW (lpString="smss.exe") returned 8 [0263.661] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.661] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.661] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.661] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.661] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.662] lstrlenW (lpString="csrss.exe") returned 9 [0263.662] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.663] lstrlenW (lpString="wininit.exe") returned 11 [0263.663] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.663] lstrlenW (lpString="csrss.exe") returned 9 [0263.663] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.664] lstrlenW (lpString="winlogon.exe") returned 12 [0263.664] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.665] lstrlenW (lpString="services.exe") returned 12 [0263.665] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.665] lstrlenW (lpString="lsass.exe") returned 9 [0263.665] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.666] lstrlenW (lpString="lsm.exe") returned 7 [0263.666] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.667] lstrlenW (lpString="svchost.exe") returned 11 [0263.667] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.667] lstrlenW (lpString="svchost.exe") returned 11 [0263.667] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.668] lstrlenW (lpString="svchost.exe") returned 11 [0263.668] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.669] lstrlenW (lpString="svchost.exe") returned 11 [0263.669] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.669] lstrlenW (lpString="svchost.exe") returned 11 [0263.669] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.670] lstrlenW (lpString="audiodg.exe") returned 11 [0263.670] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.671] lstrlenW (lpString="svchost.exe") returned 11 [0263.671] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.671] lstrlenW (lpString="svchost.exe") returned 11 [0263.671] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.672] lstrlenW (lpString="dwm.exe") returned 7 [0263.672] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.673] lstrlenW (lpString="explorer.exe") returned 12 [0263.673] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.673] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.673] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.785] lstrlenW (lpString="taskhost.exe") returned 12 [0263.785] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.785] lstrlenW (lpString="svchost.exe") returned 11 [0263.785] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0263.786] lstrlenW (lpString="taskeng.exe") returned 11 [0263.786] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.787] lstrlenW (lpString="svchost.exe") returned 11 [0263.787] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.787] lstrlenW (lpString="taskhost.exe") returned 12 [0263.788] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0263.788] lstrlenW (lpString="sppsvc.exe") returned 10 [0263.788] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.789] lstrlenW (lpString="svchost.exe") returned 11 [0263.789] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0263.790] lstrlenW (lpString="push nutrition.exe") returned 18 [0263.790] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0263.791] lstrlenW (lpString="procedures.exe") returned 14 [0263.791] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0263.792] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0263.792] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0263.793] lstrlenW (lpString="scanner-discover.exe") returned 20 [0263.793] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0263.794] lstrlenW (lpString="regression healthcare.exe") returned 25 [0263.794] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0263.794] lstrlenW (lpString="apr_zinc.exe") returned 12 [0263.795] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0263.795] lstrlenW (lpString="computer.exe") returned 12 [0263.795] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0263.796] lstrlenW (lpString="importanceweekend.exe") returned 21 [0263.796] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0263.797] lstrlenW (lpString="warm_absolute.exe") returned 17 [0263.797] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0263.798] lstrlenW (lpString="funding_editing.exe") returned 19 [0263.798] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0263.799] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0263.799] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0264.330] lstrlenW (lpString="friend.exe") returned 10 [0264.330] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0264.331] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0264.331] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0264.332] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0264.332] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0264.333] lstrlenW (lpString="individually_antiques.exe") returned 25 [0264.333] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0264.334] lstrlenW (lpString="embedded.exe") returned 12 [0264.334] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0264.335] lstrlenW (lpString="usually.exe") returned 11 [0264.335] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0264.336] lstrlenW (lpString="bills.exe") returned 9 [0264.336] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0264.337] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0264.337] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0264.338] lstrlenW (lpString="terminal.exe") returned 12 [0264.338] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0264.339] lstrlenW (lpString="ol_refers.exe") returned 13 [0264.339] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0264.340] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0264.340] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0264.341] lstrlenW (lpString="riding analyst.exe") returned 18 [0264.341] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0264.342] lstrlenW (lpString="robots.exe") returned 10 [0264.342] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0264.343] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0264.343] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.344] lstrlenW (lpString="dllhost.exe") returned 11 [0264.344] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.346] lstrlenW (lpString="dllhost.exe") returned 11 [0264.346] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0264.347] lstrlenW (lpString="expIorer32.exe") returned 14 [0264.347] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0264.348] lstrlenW (lpString="cmd.exe") returned 7 [0264.348] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0264.349] lstrlenW (lpString="conhost.exe") returned 11 [0264.349] Process32NextW (in: hSnapshot=0x1bc, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0264.350] CloseHandle (hObject=0x1bc) returned 1 [0264.350] Sleep (dwMilliseconds=0x1f4) [0265.252] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fc68 [0265.252] EnumServicesStatusExW (in: hSCManager=0x35fc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0265.253] GetLastError () returned 0xea [0265.253] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x397e760 [0265.253] EnumServicesStatusExW (in: hSCManager=0x35fc68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x397e760, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x397e760, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0265.253] CloseServiceHandle (hSCObject=0x35fc68) returned 1 [0265.253] lstrlenW (lpString="Appinfo") returned 7 [0265.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0265.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0265.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0265.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0265.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0265.254] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.254] lstrlenW (lpString="AudioSrv") returned 8 [0265.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.254] lstrlenW (lpString="BFE") returned 3 [0265.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.254] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.254] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.254] lstrlenW (lpString="CryptSvc") returned 8 [0265.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.254] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.254] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.254] lstrlenW (lpString="CscService") returned 10 [0265.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.255] lstrlenW (lpString="DcomLaunch") returned 10 [0265.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.255] lstrlenW (lpString="Dhcp") returned 4 [0265.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.255] lstrlenW (lpString="Dnscache") returned 8 [0265.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.255] lstrlenW (lpString="DPS") returned 3 [0265.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.256] lstrlenW (lpString="eventlog") returned 8 [0265.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.256] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.256] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.256] lstrlenW (lpString="EventSystem") returned 11 [0265.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.256] lstrlenW (lpString="FontCache") returned 9 [0265.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0265.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0265.256] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0265.256] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0265.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0265.256] lstrlenW (lpString="gpsvc") returned 5 [0265.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.256] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.256] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.256] lstrlenW (lpString="iphlpsvc") returned 8 [0265.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.256] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.257] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.257] lstrlenW (lpString="LanmanServer") returned 12 [0265.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.257] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.257] lstrlenW (lpString="lmhosts") returned 7 [0265.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.257] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.257] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.257] lstrlenW (lpString="MMCSS") returned 5 [0265.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.257] lstrlenW (lpString="MpsSvc") returned 6 [0265.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.258] lstrlenW (lpString="Netman") returned 6 [0265.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0265.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0265.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0265.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0265.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0265.258] lstrlenW (lpString="netprofm") returned 8 [0265.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.258] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.258] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.258] lstrlenW (lpString="NlaSvc") returned 6 [0265.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.258] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.258] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.258] lstrlenW (lpString="nsi") returned 3 [0265.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.258] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.258] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.258] lstrlenW (lpString="PcaSvc") returned 6 [0265.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.259] lstrlenW (lpString="PlugPlay") returned 8 [0265.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.259] lstrlenW (lpString="Power") returned 5 [0265.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.259] lstrlenW (lpString="ProfSvc") returned 7 [0265.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.259] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.260] lstrlenW (lpString="RpcSs") returned 5 [0265.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.260] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.260] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.260] lstrlenW (lpString="SamSs") returned 5 [0265.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.260] lstrlenW (lpString="Schedule") returned 8 [0265.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.260] lstrlenW (lpString="SENS") returned 4 [0265.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.260] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.260] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.261] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.261] lstrlenW (lpString="Spooler") returned 7 [0265.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.261] lstrlenW (lpString="sppsvc") returned 6 [0265.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0265.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0265.261] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0265.261] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0265.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0265.261] lstrlenW (lpString="SysMain") returned 7 [0265.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.261] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.261] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.261] lstrlenW (lpString="Themes") returned 6 [0265.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.261] lstrlenW (lpString="TrkWks") returned 6 [0265.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0265.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0265.262] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0265.262] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0265.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0265.262] lstrlenW (lpString="UxSms") returned 5 [0265.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.262] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.262] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.262] lstrlenW (lpString="WdiServiceHost") returned 14 [0265.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0265.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0265.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0265.262] lstrlenW (lpString="WdiSystemHost") returned 13 [0265.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0265.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0265.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0265.262] lstrlenW (lpString="WinDefend") returned 9 [0265.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0265.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0265.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0265.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0265.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0265.262] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0265.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0265.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0265.263] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0265.263] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0265.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0265.263] lstrlenW (lpString="Winmgmt") returned 7 [0265.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0265.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0265.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0265.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0265.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0265.263] lstrlenW (lpString="wscsvc") returned 6 [0265.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0265.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0265.263] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0265.263] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0265.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0265.263] lstrlenW (lpString="wuauserv") returned 8 [0265.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0265.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0265.263] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0265.263] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0265.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0265.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x397e760 | out: hHeap=0x2e0000) returned 1 [0265.263] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0265.266] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.267] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.268] lstrlenW (lpString="System") returned 6 [0265.268] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.268] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.268] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.268] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.269] lstrlenW (lpString="smss.exe") returned 8 [0265.269] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.269] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.269] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.269] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.269] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.269] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.269] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.270] lstrlenW (lpString="csrss.exe") returned 9 [0265.270] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.271] lstrlenW (lpString="wininit.exe") returned 11 [0265.271] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.272] lstrlenW (lpString="csrss.exe") returned 9 [0265.272] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.273] lstrlenW (lpString="winlogon.exe") returned 12 [0265.273] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.274] lstrlenW (lpString="services.exe") returned 12 [0265.274] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.275] lstrlenW (lpString="lsass.exe") returned 9 [0265.275] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.276] lstrlenW (lpString="lsm.exe") returned 7 [0265.276] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.277] lstrlenW (lpString="svchost.exe") returned 11 [0265.277] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.277] lstrlenW (lpString="svchost.exe") returned 11 [0265.277] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.278] lstrlenW (lpString="svchost.exe") returned 11 [0265.278] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.279] lstrlenW (lpString="svchost.exe") returned 11 [0265.279] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.280] lstrlenW (lpString="svchost.exe") returned 11 [0265.280] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.281] lstrlenW (lpString="audiodg.exe") returned 11 [0265.281] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.282] lstrlenW (lpString="svchost.exe") returned 11 [0265.282] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.283] lstrlenW (lpString="svchost.exe") returned 11 [0265.283] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.284] lstrlenW (lpString="dwm.exe") returned 7 [0265.284] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.285] lstrlenW (lpString="explorer.exe") returned 12 [0265.285] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.285] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.286] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.286] lstrlenW (lpString="taskhost.exe") returned 12 [0265.286] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.287] lstrlenW (lpString="svchost.exe") returned 11 [0265.287] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0265.288] lstrlenW (lpString="taskeng.exe") returned 11 [0265.288] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.289] lstrlenW (lpString="svchost.exe") returned 11 [0265.289] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.290] lstrlenW (lpString="taskhost.exe") returned 12 [0265.290] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0265.291] lstrlenW (lpString="sppsvc.exe") returned 10 [0265.291] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.292] lstrlenW (lpString="svchost.exe") returned 11 [0265.292] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0265.292] lstrlenW (lpString="push nutrition.exe") returned 18 [0265.293] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0265.293] lstrlenW (lpString="procedures.exe") returned 14 [0265.293] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0265.294] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0265.294] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0265.295] lstrlenW (lpString="scanner-discover.exe") returned 20 [0265.295] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0265.296] lstrlenW (lpString="regression healthcare.exe") returned 25 [0265.296] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0265.595] lstrlenW (lpString="apr_zinc.exe") returned 12 [0265.595] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0265.596] lstrlenW (lpString="computer.exe") returned 12 [0265.596] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0265.596] lstrlenW (lpString="importanceweekend.exe") returned 21 [0265.596] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0265.597] lstrlenW (lpString="warm_absolute.exe") returned 17 [0265.597] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0265.598] lstrlenW (lpString="funding_editing.exe") returned 19 [0265.598] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0265.598] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0265.598] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0265.599] lstrlenW (lpString="friend.exe") returned 10 [0265.599] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0265.600] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0265.600] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0265.600] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0265.600] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0265.601] lstrlenW (lpString="individually_antiques.exe") returned 25 [0265.601] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0265.602] lstrlenW (lpString="embedded.exe") returned 12 [0265.602] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0265.602] lstrlenW (lpString="usually.exe") returned 11 [0265.603] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0265.603] lstrlenW (lpString="bills.exe") returned 9 [0265.603] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0265.604] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0265.604] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0265.604] lstrlenW (lpString="terminal.exe") returned 12 [0265.605] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0265.605] lstrlenW (lpString="ol_refers.exe") returned 13 [0265.605] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0265.606] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0265.606] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0265.606] lstrlenW (lpString="riding analyst.exe") returned 18 [0265.607] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0265.607] lstrlenW (lpString="robots.exe") returned 10 [0265.607] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.608] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0265.608] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.609] lstrlenW (lpString="dllhost.exe") returned 11 [0265.609] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.609] lstrlenW (lpString="dllhost.exe") returned 11 [0265.609] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0265.610] lstrlenW (lpString="expIorer32.exe") returned 14 [0265.610] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0265.611] lstrlenW (lpString="cmd.exe") returned 7 [0265.611] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0265.612] lstrlenW (lpString="conhost.exe") returned 11 [0265.612] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0265.612] lstrlenW (lpString="vssadmin.exe") returned 12 [0265.613] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0265.613] CloseHandle (hObject=0x1c4) returned 1 [0265.613] Sleep (dwMilliseconds=0x1f4) [0267.078] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3600c8 [0267.078] EnumServicesStatusExW (in: hSCManager=0x3600c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0267.078] GetLastError () returned 0xea [0267.078] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x3fa48d0 [0267.078] EnumServicesStatusExW (in: hSCManager=0x3600c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fa48d0, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fa48d0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0267.079] CloseServiceHandle (hSCObject=0x3600c8) returned 1 [0267.079] lstrlenW (lpString="Appinfo") returned 7 [0267.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0267.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0267.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0267.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0267.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0267.079] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.079] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.079] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.080] lstrlenW (lpString="AudioSrv") returned 8 [0267.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.080] lstrlenW (lpString="BFE") returned 3 [0267.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.080] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.080] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.080] lstrlenW (lpString="CryptSvc") returned 8 [0267.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0267.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0267.080] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0267.080] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0267.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0267.080] lstrlenW (lpString="CscService") returned 10 [0267.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.080] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.080] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.080] lstrlenW (lpString="DcomLaunch") returned 10 [0267.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.081] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.081] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.081] lstrlenW (lpString="Dhcp") returned 4 [0267.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.081] lstrlenW (lpString="Dnscache") returned 8 [0267.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.081] lstrlenW (lpString="DPS") returned 3 [0267.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0267.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0267.081] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0267.081] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0267.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0267.081] lstrlenW (lpString="eventlog") returned 8 [0267.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.081] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.081] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.081] lstrlenW (lpString="EventSystem") returned 11 [0267.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.082] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.082] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.082] lstrlenW (lpString="FontCache") returned 9 [0267.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0267.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0267.082] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0267.082] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0267.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0267.082] lstrlenW (lpString="gpsvc") returned 5 [0267.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.082] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.082] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.082] lstrlenW (lpString="iphlpsvc") returned 8 [0267.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.082] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0267.082] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0267.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0267.082] lstrlenW (lpString="LanmanServer") returned 12 [0267.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0267.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0267.082] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0267.082] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0267.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0267.083] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.083] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.083] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.083] lstrlenW (lpString="lmhosts") returned 7 [0267.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.083] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.083] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.083] lstrlenW (lpString="MMCSS") returned 5 [0267.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.083] lstrlenW (lpString="MpsSvc") returned 6 [0267.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.083] lstrlenW (lpString="Netman") returned 6 [0267.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0267.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0267.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0267.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0267.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0267.084] lstrlenW (lpString="netprofm") returned 8 [0267.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.084] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.084] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.084] lstrlenW (lpString="NlaSvc") returned 6 [0267.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.084] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.084] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.084] lstrlenW (lpString="nsi") returned 3 [0267.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.084] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.084] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.084] lstrlenW (lpString="PcaSvc") returned 6 [0267.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.084] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.084] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.084] lstrlenW (lpString="PlugPlay") returned 8 [0267.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.085] lstrlenW (lpString="Power") returned 5 [0267.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.085] lstrlenW (lpString="ProfSvc") returned 7 [0267.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.085] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.085] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.085] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.086] lstrlenW (lpString="RpcSs") returned 5 [0267.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.086] lstrlenW (lpString="SamSs") returned 5 [0267.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.086] lstrlenW (lpString="Schedule") returned 8 [0267.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.086] lstrlenW (lpString="SENS") returned 4 [0267.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.086] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.087] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.087] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.087] lstrlenW (lpString="Spooler") returned 7 [0267.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.087] lstrlenW (lpString="sppsvc") returned 6 [0267.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0267.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0267.087] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0267.087] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0267.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0267.087] lstrlenW (lpString="SysMain") returned 7 [0267.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.087] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.087] lstrlenW (lpString="Themes") returned 6 [0267.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.087] lstrlenW (lpString="TrkWks") returned 6 [0267.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0267.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0267.088] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0267.088] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0267.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0267.088] lstrlenW (lpString="UxSms") returned 5 [0267.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.088] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.088] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.088] lstrlenW (lpString="WdiServiceHost") returned 14 [0267.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0267.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0267.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0267.088] lstrlenW (lpString="WdiSystemHost") returned 13 [0267.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0267.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0267.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0267.088] lstrlenW (lpString="WinDefend") returned 9 [0267.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0267.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0267.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0267.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0267.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0267.089] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0267.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0267.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0267.089] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0267.089] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0267.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0267.089] lstrlenW (lpString="Winmgmt") returned 7 [0267.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0267.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0267.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0267.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0267.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0267.089] lstrlenW (lpString="wscsvc") returned 6 [0267.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0267.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0267.089] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0267.089] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0267.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0267.089] lstrlenW (lpString="wuauserv") returned 8 [0267.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0267.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0267.089] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0267.089] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0267.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0267.089] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fa48d0 | out: hHeap=0x2e0000) returned 1 [0267.089] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0267.092] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.093] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.094] lstrlenW (lpString="System") returned 6 [0267.094] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.094] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.094] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.094] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.095] lstrlenW (lpString="smss.exe") returned 8 [0267.095] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.095] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.095] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.095] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.095] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.095] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.095] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.095] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.096] lstrlenW (lpString="csrss.exe") returned 9 [0267.096] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.097] lstrlenW (lpString="wininit.exe") returned 11 [0267.097] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.098] lstrlenW (lpString="csrss.exe") returned 9 [0267.098] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.099] lstrlenW (lpString="winlogon.exe") returned 12 [0267.099] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.100] lstrlenW (lpString="services.exe") returned 12 [0267.100] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.101] lstrlenW (lpString="lsass.exe") returned 9 [0267.101] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.102] lstrlenW (lpString="lsm.exe") returned 7 [0267.102] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.103] lstrlenW (lpString="svchost.exe") returned 11 [0267.103] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.104] lstrlenW (lpString="svchost.exe") returned 11 [0267.104] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.105] lstrlenW (lpString="svchost.exe") returned 11 [0267.105] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.105] lstrlenW (lpString="svchost.exe") returned 11 [0267.105] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.106] lstrlenW (lpString="svchost.exe") returned 11 [0267.106] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.107] lstrlenW (lpString="audiodg.exe") returned 11 [0267.107] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.108] lstrlenW (lpString="svchost.exe") returned 11 [0267.108] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.109] lstrlenW (lpString="svchost.exe") returned 11 [0267.109] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.110] lstrlenW (lpString="dwm.exe") returned 7 [0267.110] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.111] lstrlenW (lpString="explorer.exe") returned 12 [0267.111] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.112] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.112] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.113] lstrlenW (lpString="taskhost.exe") returned 12 [0267.113] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.113] lstrlenW (lpString="svchost.exe") returned 11 [0267.114] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0267.114] lstrlenW (lpString="taskeng.exe") returned 11 [0267.114] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.115] lstrlenW (lpString="svchost.exe") returned 11 [0267.115] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.116] lstrlenW (lpString="taskhost.exe") returned 12 [0267.116] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0267.117] lstrlenW (lpString="sppsvc.exe") returned 10 [0267.117] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.118] lstrlenW (lpString="svchost.exe") returned 11 [0267.118] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0267.119] lstrlenW (lpString="push nutrition.exe") returned 18 [0267.119] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0267.120] lstrlenW (lpString="procedures.exe") returned 14 [0267.120] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0267.120] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0267.121] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0267.121] lstrlenW (lpString="scanner-discover.exe") returned 20 [0267.121] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0267.591] lstrlenW (lpString="regression healthcare.exe") returned 25 [0267.591] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0267.592] lstrlenW (lpString="apr_zinc.exe") returned 12 [0267.592] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0267.593] lstrlenW (lpString="computer.exe") returned 12 [0267.593] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0267.594] lstrlenW (lpString="importanceweekend.exe") returned 21 [0267.594] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0267.595] lstrlenW (lpString="warm_absolute.exe") returned 17 [0267.595] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0267.596] lstrlenW (lpString="funding_editing.exe") returned 19 [0267.596] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0267.597] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0267.597] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0267.597] lstrlenW (lpString="friend.exe") returned 10 [0267.598] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0267.598] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0267.598] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0267.599] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0267.599] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0267.600] lstrlenW (lpString="individually_antiques.exe") returned 25 [0267.600] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0267.601] lstrlenW (lpString="embedded.exe") returned 12 [0267.601] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0267.602] lstrlenW (lpString="usually.exe") returned 11 [0267.602] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0267.603] lstrlenW (lpString="bills.exe") returned 9 [0267.603] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0267.604] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0267.604] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0267.605] lstrlenW (lpString="terminal.exe") returned 12 [0267.605] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0267.605] lstrlenW (lpString="ol_refers.exe") returned 13 [0267.606] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0267.607] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0267.607] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0267.607] lstrlenW (lpString="riding analyst.exe") returned 18 [0267.607] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0267.608] lstrlenW (lpString="robots.exe") returned 10 [0267.608] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0267.609] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0267.609] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.610] lstrlenW (lpString="dllhost.exe") returned 11 [0267.610] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.611] lstrlenW (lpString="dllhost.exe") returned 11 [0267.611] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0267.612] lstrlenW (lpString="expIorer32.exe") returned 14 [0267.612] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0267.613] lstrlenW (lpString="cmd.exe") returned 7 [0267.613] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0267.614] lstrlenW (lpString="conhost.exe") returned 11 [0267.614] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0267.615] lstrlenW (lpString="vssadmin.exe") returned 12 [0267.615] Process32NextW (in: hSnapshot=0x1e8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0267.616] CloseHandle (hObject=0x1e8) returned 1 [0267.616] Sleep (dwMilliseconds=0x1f4) [0268.152] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3600c8 [0268.152] EnumServicesStatusExW (in: hSCManager=0x3600c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0268.153] GetLastError () returned 0xea [0268.153] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x39776f8 [0268.153] EnumServicesStatusExW (in: hSCManager=0x3600c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0268.155] CloseServiceHandle (hSCObject=0x3600c8) returned 1 [0268.155] lstrlenW (lpString="Appinfo") returned 7 [0268.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.155] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.155] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.155] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.155] lstrlenW (lpString="AudioSrv") returned 8 [0268.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0268.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0268.155] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0268.155] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0268.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0268.156] lstrlenW (lpString="BFE") returned 3 [0268.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.156] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.156] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.156] lstrlenW (lpString="CryptSvc") returned 8 [0268.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.156] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.156] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.156] lstrlenW (lpString="CscService") returned 10 [0268.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0268.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0268.156] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0268.156] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0268.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0268.156] lstrlenW (lpString="DcomLaunch") returned 10 [0268.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.156] lstrlenW (lpString="Dhcp") returned 4 [0268.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.157] lstrlenW (lpString="Dnscache") returned 8 [0268.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.157] lstrlenW (lpString="DPS") returned 3 [0268.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.157] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.157] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.157] lstrlenW (lpString="eventlog") returned 8 [0268.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0268.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0268.157] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0268.157] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0268.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0268.157] lstrlenW (lpString="EventSystem") returned 11 [0268.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.157] lstrlenW (lpString="FontCache") returned 9 [0268.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0268.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0268.157] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0268.157] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0268.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0268.157] lstrlenW (lpString="gpsvc") returned 5 [0268.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.158] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.158] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.158] lstrlenW (lpString="iphlpsvc") returned 8 [0268.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.158] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.158] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.165] lstrlenW (lpString="LanmanServer") returned 12 [0268.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.165] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.165] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.165] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.165] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.165] lstrlenW (lpString="lmhosts") returned 7 [0268.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.165] lstrlenW (lpString="MMCSS") returned 5 [0268.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0268.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0268.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0268.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0268.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0268.165] lstrlenW (lpString="MpsSvc") returned 6 [0268.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.166] lstrlenW (lpString="Netman") returned 6 [0268.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0268.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0268.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0268.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0268.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0268.166] lstrlenW (lpString="netprofm") returned 8 [0268.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.166] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.166] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.166] lstrlenW (lpString="NlaSvc") returned 6 [0268.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.166] lstrlenW (lpString="nsi") returned 3 [0268.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.166] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.166] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.166] lstrlenW (lpString="PcaSvc") returned 6 [0268.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.167] lstrlenW (lpString="PlugPlay") returned 8 [0268.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.167] lstrlenW (lpString="Power") returned 5 [0268.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.167] lstrlenW (lpString="ProfSvc") returned 7 [0268.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.167] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.167] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.167] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.168] lstrlenW (lpString="RpcSs") returned 5 [0268.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.168] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.168] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.168] lstrlenW (lpString="SamSs") returned 5 [0268.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.169] lstrlenW (lpString="Schedule") returned 8 [0268.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.169] lstrlenW (lpString="SENS") returned 4 [0268.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.175] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.175] lstrlenW (lpString="Spooler") returned 7 [0268.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.175] lstrlenW (lpString="sppsvc") returned 6 [0268.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0268.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0268.175] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0268.175] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0268.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0268.175] lstrlenW (lpString="SysMain") returned 7 [0268.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.175] lstrlenW (lpString="Themes") returned 6 [0268.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0268.176] lstrlenW (lpString="TrkWks") returned 6 [0268.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0268.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0268.176] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0268.176] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0268.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0268.176] lstrlenW (lpString="UxSms") returned 5 [0268.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0268.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0268.176] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0268.176] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0268.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0268.176] lstrlenW (lpString="WdiServiceHost") returned 14 [0268.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0268.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0268.176] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0268.176] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0268.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0268.176] lstrlenW (lpString="WdiSystemHost") returned 13 [0268.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0268.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0268.176] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0268.176] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0268.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0268.177] lstrlenW (lpString="WinDefend") returned 9 [0268.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0268.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0268.177] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0268.177] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0268.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0268.177] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0268.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0268.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0268.177] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0268.177] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0268.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0268.177] lstrlenW (lpString="Winmgmt") returned 7 [0268.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0268.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0268.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0268.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0268.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0268.178] lstrlenW (lpString="wscsvc") returned 6 [0268.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0268.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0268.178] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0268.178] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0268.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0268.178] lstrlenW (lpString="wuauserv") returned 8 [0268.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0268.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0268.178] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0268.178] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0268.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0268.179] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0268.179] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0268.181] Process32FirstW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.182] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.217] lstrlenW (lpString="System") returned 6 [0268.217] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0268.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0268.217] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0268.217] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0268.217] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0268.217] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0268.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0268.270] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.271] lstrlenW (lpString="smss.exe") returned 8 [0268.271] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0268.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0268.271] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0268.271] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0268.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0268.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0268.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0268.271] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.272] lstrlenW (lpString="csrss.exe") returned 9 [0268.272] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.272] lstrlenW (lpString="wininit.exe") returned 11 [0268.273] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.273] lstrlenW (lpString="csrss.exe") returned 9 [0268.273] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.274] lstrlenW (lpString="winlogon.exe") returned 12 [0268.274] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.275] lstrlenW (lpString="services.exe") returned 12 [0268.275] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.275] lstrlenW (lpString="lsass.exe") returned 9 [0268.275] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0268.276] lstrlenW (lpString="lsm.exe") returned 7 [0268.276] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.277] lstrlenW (lpString="svchost.exe") returned 11 [0268.277] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.278] lstrlenW (lpString="svchost.exe") returned 11 [0268.278] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.279] lstrlenW (lpString="svchost.exe") returned 11 [0268.279] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.279] lstrlenW (lpString="svchost.exe") returned 11 [0268.279] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.280] lstrlenW (lpString="svchost.exe") returned 11 [0268.280] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.281] lstrlenW (lpString="audiodg.exe") returned 11 [0268.281] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.281] lstrlenW (lpString="svchost.exe") returned 11 [0268.282] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.282] lstrlenW (lpString="svchost.exe") returned 11 [0268.282] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.283] lstrlenW (lpString="dwm.exe") returned 7 [0268.283] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.284] lstrlenW (lpString="explorer.exe") returned 12 [0268.284] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.285] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.285] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.285] lstrlenW (lpString="taskhost.exe") returned 12 [0268.286] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.286] lstrlenW (lpString="svchost.exe") returned 11 [0268.286] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0268.287] lstrlenW (lpString="taskeng.exe") returned 11 [0268.496] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.497] lstrlenW (lpString="svchost.exe") returned 11 [0268.497] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.498] lstrlenW (lpString="taskhost.exe") returned 12 [0268.498] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0268.499] lstrlenW (lpString="sppsvc.exe") returned 10 [0268.499] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.500] lstrlenW (lpString="svchost.exe") returned 11 [0268.500] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0268.501] lstrlenW (lpString="push nutrition.exe") returned 18 [0268.502] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0268.503] lstrlenW (lpString="procedures.exe") returned 14 [0268.503] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0268.504] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0268.504] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0268.505] lstrlenW (lpString="scanner-discover.exe") returned 20 [0268.505] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0268.548] lstrlenW (lpString="regression healthcare.exe") returned 25 [0268.548] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0268.550] lstrlenW (lpString="apr_zinc.exe") returned 12 [0268.550] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0268.551] lstrlenW (lpString="computer.exe") returned 12 [0268.551] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0268.552] lstrlenW (lpString="importanceweekend.exe") returned 21 [0268.552] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0268.553] lstrlenW (lpString="warm_absolute.exe") returned 17 [0268.553] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0268.614] lstrlenW (lpString="funding_editing.exe") returned 19 [0268.614] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0268.616] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0268.616] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0268.617] lstrlenW (lpString="friend.exe") returned 10 [0268.617] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0268.618] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0268.618] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0268.619] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0268.619] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0268.621] lstrlenW (lpString="individually_antiques.exe") returned 25 [0268.621] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0268.635] lstrlenW (lpString="embedded.exe") returned 12 [0268.639] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0268.641] lstrlenW (lpString="usually.exe") returned 11 [0268.641] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0268.642] lstrlenW (lpString="bills.exe") returned 9 [0268.642] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0268.643] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0268.643] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0268.644] lstrlenW (lpString="terminal.exe") returned 12 [0268.644] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0268.645] lstrlenW (lpString="ol_refers.exe") returned 13 [0268.645] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0268.646] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0268.647] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0268.648] lstrlenW (lpString="riding analyst.exe") returned 18 [0268.648] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0268.649] lstrlenW (lpString="robots.exe") returned 10 [0268.649] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0268.650] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0268.650] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0268.795] lstrlenW (lpString="expIorer32.exe") returned 14 [0268.795] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0268.797] lstrlenW (lpString="cmd.exe") returned 7 [0268.797] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0268.798] lstrlenW (lpString="conhost.exe") returned 11 [0268.798] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0268.799] lstrlenW (lpString="vssadmin.exe") returned 12 [0268.799] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0268.800] CloseHandle (hObject=0x18c) returned 1 [0268.800] Sleep (dwMilliseconds=0x1f4) [0269.562] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3600c8 [0269.562] EnumServicesStatusExW (in: hSCManager=0x3600c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0269.562] GetLastError () returned 0xea [0269.562] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x134c) returned 0x39776f8 [0269.563] EnumServicesStatusExW (in: hSCManager=0x3600c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x134c, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0269.563] CloseServiceHandle (hSCObject=0x3600c8) returned 1 [0269.563] lstrlenW (lpString="Appinfo") returned 7 [0269.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0269.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0269.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0269.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0269.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0269.564] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.564] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.564] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.564] lstrlenW (lpString="AudioSrv") returned 8 [0269.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0269.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0269.564] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0269.564] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0269.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0269.564] lstrlenW (lpString="BFE") returned 3 [0269.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.564] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.564] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.564] lstrlenW (lpString="CryptSvc") returned 8 [0269.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.564] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.564] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.565] lstrlenW (lpString="CscService") returned 10 [0269.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0269.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0269.565] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0269.565] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0269.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0269.565] lstrlenW (lpString="DcomLaunch") returned 10 [0269.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.565] lstrlenW (lpString="Dhcp") returned 4 [0269.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.565] lstrlenW (lpString="Dnscache") returned 8 [0269.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.565] lstrlenW (lpString="DPS") returned 3 [0269.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.566] lstrlenW (lpString="eventlog") returned 8 [0269.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0269.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0269.566] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0269.566] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0269.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0269.566] lstrlenW (lpString="EventSystem") returned 11 [0269.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.566] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.566] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.566] lstrlenW (lpString="FontCache") returned 9 [0269.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0269.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0269.566] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0269.566] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0269.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0269.566] lstrlenW (lpString="gpsvc") returned 5 [0269.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.566] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.566] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.566] lstrlenW (lpString="iphlpsvc") returned 8 [0269.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.566] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.567] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.567] lstrlenW (lpString="LanmanServer") returned 12 [0269.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.567] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.567] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.567] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.567] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.567] lstrlenW (lpString="lmhosts") returned 7 [0269.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.567] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.567] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.567] lstrlenW (lpString="MMCSS") returned 5 [0269.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0269.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0269.567] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0269.567] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0269.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0269.567] lstrlenW (lpString="MpsSvc") returned 6 [0269.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.568] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.568] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.568] lstrlenW (lpString="Netman") returned 6 [0269.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0269.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0269.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0269.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0269.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0269.568] lstrlenW (lpString="netprofm") returned 8 [0269.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.568] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.568] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.568] lstrlenW (lpString="NlaSvc") returned 6 [0269.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.568] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.568] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.568] lstrlenW (lpString="nsi") returned 3 [0269.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.568] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.568] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.569] lstrlenW (lpString="PcaSvc") returned 6 [0269.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.569] lstrlenW (lpString="PlugPlay") returned 8 [0269.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.569] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.569] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.569] lstrlenW (lpString="Power") returned 5 [0269.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.569] lstrlenW (lpString="ProfSvc") returned 7 [0269.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.569] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.569] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.570] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.570] lstrlenW (lpString="RpcSs") returned 5 [0269.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.570] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.570] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.570] lstrlenW (lpString="SamSs") returned 5 [0269.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.570] lstrlenW (lpString="Schedule") returned 8 [0269.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.570] lstrlenW (lpString="SENS") returned 4 [0269.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.570] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.571] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.571] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.571] lstrlenW (lpString="Spooler") returned 7 [0269.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.571] lstrlenW (lpString="sppsvc") returned 6 [0269.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0269.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0269.571] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0269.571] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0269.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0269.571] lstrlenW (lpString="SysMain") returned 7 [0269.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.571] lstrlenW (lpString="Themes") returned 6 [0269.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.572] lstrlenW (lpString="TrkWks") returned 6 [0269.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0269.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0269.572] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0269.572] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0269.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0269.572] lstrlenW (lpString="UxSms") returned 5 [0269.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0269.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0269.572] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0269.572] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0269.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0269.572] lstrlenW (lpString="WdiServiceHost") returned 14 [0269.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0269.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0269.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0269.572] lstrlenW (lpString="WdiSystemHost") returned 13 [0269.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0269.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0269.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0269.572] lstrlenW (lpString="WinDefend") returned 9 [0269.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0269.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0269.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0269.573] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0269.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0269.573] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0269.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.573] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0269.573] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0269.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0269.573] lstrlenW (lpString="Winmgmt") returned 7 [0269.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0269.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0269.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0269.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0269.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0269.573] lstrlenW (lpString="wscsvc") returned 6 [0269.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0269.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0269.573] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0269.573] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0269.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0269.573] lstrlenW (lpString="wuauserv") returned 8 [0269.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0269.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0269.573] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0269.573] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0269.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0269.573] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0269.573] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0269.576] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.577] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.578] lstrlenW (lpString="System") returned 6 [0269.578] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0269.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0269.578] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0269.578] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0269.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0269.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0269.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0269.578] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.579] lstrlenW (lpString="smss.exe") returned 8 [0269.579] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0269.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0269.579] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0269.579] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0269.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0269.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0269.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0269.579] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.580] lstrlenW (lpString="csrss.exe") returned 9 [0269.580] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.581] lstrlenW (lpString="wininit.exe") returned 11 [0269.581] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.582] lstrlenW (lpString="csrss.exe") returned 9 [0269.582] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.582] lstrlenW (lpString="winlogon.exe") returned 12 [0269.582] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.583] lstrlenW (lpString="services.exe") returned 12 [0269.583] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.584] lstrlenW (lpString="lsass.exe") returned 9 [0269.584] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.585] lstrlenW (lpString="lsm.exe") returned 7 [0269.585] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.586] lstrlenW (lpString="svchost.exe") returned 11 [0269.586] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.587] lstrlenW (lpString="svchost.exe") returned 11 [0269.587] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.594] lstrlenW (lpString="svchost.exe") returned 11 [0269.594] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.595] lstrlenW (lpString="svchost.exe") returned 11 [0269.595] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.596] lstrlenW (lpString="svchost.exe") returned 11 [0269.596] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.597] lstrlenW (lpString="audiodg.exe") returned 11 [0269.597] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.598] lstrlenW (lpString="svchost.exe") returned 11 [0269.598] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.599] lstrlenW (lpString="svchost.exe") returned 11 [0269.599] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.600] lstrlenW (lpString="dwm.exe") returned 7 [0269.600] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.600] lstrlenW (lpString="explorer.exe") returned 12 [0269.600] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.601] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.601] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.602] lstrlenW (lpString="taskhost.exe") returned 12 [0269.602] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.853] lstrlenW (lpString="svchost.exe") returned 11 [0269.853] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0269.854] lstrlenW (lpString="taskeng.exe") returned 11 [0269.854] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.855] lstrlenW (lpString="svchost.exe") returned 11 [0269.855] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.856] lstrlenW (lpString="taskhost.exe") returned 12 [0269.856] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0269.858] lstrlenW (lpString="sppsvc.exe") returned 10 [0269.858] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.859] lstrlenW (lpString="svchost.exe") returned 11 [0269.859] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0269.860] lstrlenW (lpString="push nutrition.exe") returned 18 [0269.860] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0269.860] lstrlenW (lpString="procedures.exe") returned 14 [0269.860] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0269.861] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0269.861] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0269.862] lstrlenW (lpString="scanner-discover.exe") returned 20 [0269.862] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0269.863] lstrlenW (lpString="regression healthcare.exe") returned 25 [0269.863] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0269.864] lstrlenW (lpString="apr_zinc.exe") returned 12 [0269.864] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0269.899] lstrlenW (lpString="computer.exe") returned 12 [0269.899] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0269.900] lstrlenW (lpString="importanceweekend.exe") returned 21 [0269.900] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0269.901] lstrlenW (lpString="warm_absolute.exe") returned 17 [0269.901] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0269.902] lstrlenW (lpString="funding_editing.exe") returned 19 [0269.902] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0269.903] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0269.903] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0269.903] lstrlenW (lpString="friend.exe") returned 10 [0269.903] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0269.904] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0269.904] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0269.905] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0269.905] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0269.906] lstrlenW (lpString="individually_antiques.exe") returned 25 [0269.906] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0269.907] lstrlenW (lpString="embedded.exe") returned 12 [0269.907] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0269.908] lstrlenW (lpString="usually.exe") returned 11 [0269.908] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0269.908] lstrlenW (lpString="bills.exe") returned 9 [0269.908] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0269.909] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0269.909] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0269.910] lstrlenW (lpString="terminal.exe") returned 12 [0269.910] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0269.911] lstrlenW (lpString="ol_refers.exe") returned 13 [0269.911] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0269.912] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0269.912] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0269.912] lstrlenW (lpString="riding analyst.exe") returned 18 [0269.912] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0269.913] lstrlenW (lpString="robots.exe") returned 10 [0269.913] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0269.914] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0269.914] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0269.915] lstrlenW (lpString="expIorer32.exe") returned 14 [0269.915] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0269.916] lstrlenW (lpString="cmd.exe") returned 7 [0269.916] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0269.917] lstrlenW (lpString="conhost.exe") returned 11 [0269.917] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0269.918] lstrlenW (lpString="vssadmin.exe") returned 12 [0269.918] Process32NextW (in: hSnapshot=0x1e4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0269.918] CloseHandle (hObject=0x1e4) returned 1 [0269.918] Sleep (dwMilliseconds=0x1f4) [0270.620] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0270.621] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0270.621] GetLastError () returned 0xea [0270.621] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0270.621] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0270.622] CloseServiceHandle (hSCObject=0x360140) returned 1 [0270.622] lstrlenW (lpString="Appinfo") returned 7 [0270.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0270.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0270.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0270.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0270.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0270.622] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0270.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.622] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0270.622] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0270.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0270.622] lstrlenW (lpString="AudioSrv") returned 8 [0270.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0270.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0270.622] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0270.622] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0270.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0270.622] lstrlenW (lpString="BFE") returned 3 [0270.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0270.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0270.623] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0270.623] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0270.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0270.623] lstrlenW (lpString="CryptSvc") returned 8 [0270.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0270.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0270.623] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0270.623] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0270.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0270.623] lstrlenW (lpString="CscService") returned 10 [0270.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0270.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0270.623] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0270.623] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0270.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0270.623] lstrlenW (lpString="DcomLaunch") returned 10 [0270.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0270.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0270.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0270.623] lstrlenW (lpString="Dhcp") returned 4 [0270.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0270.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0270.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0270.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0270.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0270.623] lstrlenW (lpString="Dnscache") returned 8 [0270.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0270.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0270.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0270.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0270.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0270.624] lstrlenW (lpString="DPS") returned 3 [0270.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0270.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0270.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0270.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0270.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0270.624] lstrlenW (lpString="eventlog") returned 8 [0270.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0270.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0270.624] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0270.624] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0270.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0270.624] lstrlenW (lpString="EventSystem") returned 11 [0270.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0270.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0270.624] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0270.624] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0270.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0270.624] lstrlenW (lpString="FontCache") returned 9 [0270.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0270.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0270.624] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0270.624] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0270.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0270.624] lstrlenW (lpString="gpsvc") returned 5 [0270.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.624] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.624] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.625] lstrlenW (lpString="iphlpsvc") returned 8 [0270.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.664] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0270.664] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0270.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0270.664] lstrlenW (lpString="LanmanServer") returned 12 [0270.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0270.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0270.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0270.664] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0270.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0270.664] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.664] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.664] lstrlenW (lpString="lmhosts") returned 7 [0270.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.664] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.664] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.664] lstrlenW (lpString="MMCSS") returned 5 [0270.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0270.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0270.664] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0270.664] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0270.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0270.664] lstrlenW (lpString="MpsSvc") returned 6 [0270.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.664] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.664] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.664] lstrlenW (lpString="Netman") returned 6 [0270.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0270.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0270.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0270.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0270.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0270.665] lstrlenW (lpString="netprofm") returned 8 [0270.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0270.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0270.665] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0270.665] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0270.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0270.665] lstrlenW (lpString="NlaSvc") returned 6 [0270.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.665] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.665] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.665] lstrlenW (lpString="nsi") returned 3 [0270.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.665] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.665] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.665] lstrlenW (lpString="PcaSvc") returned 6 [0270.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.665] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.665] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.665] lstrlenW (lpString="PlugPlay") returned 8 [0270.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.665] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.666] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.666] lstrlenW (lpString="Power") returned 5 [0270.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.666] lstrlenW (lpString="ProfSvc") returned 7 [0270.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.666] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.666] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.666] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.666] lstrlenW (lpString="RpcSs") returned 5 [0270.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.666] lstrlenW (lpString="SamSs") returned 5 [0270.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.666] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.666] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.667] lstrlenW (lpString="Schedule") returned 8 [0270.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.667] lstrlenW (lpString="SENS") returned 4 [0270.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.667] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.667] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.667] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.667] lstrlenW (lpString="Spooler") returned 7 [0270.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.667] lstrlenW (lpString="sppsvc") returned 6 [0270.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0270.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0270.667] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0270.667] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0270.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0270.667] lstrlenW (lpString="SysMain") returned 7 [0270.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0270.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0270.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0270.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0270.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0270.668] lstrlenW (lpString="Themes") returned 6 [0270.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0270.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0270.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0270.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0270.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0270.668] lstrlenW (lpString="TrkWks") returned 6 [0270.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0270.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0270.668] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0270.668] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0270.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0270.668] lstrlenW (lpString="UxSms") returned 5 [0270.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0270.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0270.668] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0270.668] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0270.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0270.668] lstrlenW (lpString="VSS") returned 3 [0270.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0270.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0270.668] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0270.668] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0270.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0270.668] lstrlenW (lpString="WdiServiceHost") returned 14 [0270.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0270.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0270.668] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0270.668] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0270.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0270.668] lstrlenW (lpString="WdiSystemHost") returned 13 [0270.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0270.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0270.669] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0270.669] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0270.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0270.669] lstrlenW (lpString="WinDefend") returned 9 [0270.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0270.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0270.669] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0270.669] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0270.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0270.669] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0270.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0270.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0270.669] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0270.669] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0270.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0270.669] lstrlenW (lpString="Winmgmt") returned 7 [0270.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0270.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0270.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0270.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0270.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0270.669] lstrlenW (lpString="wscsvc") returned 6 [0270.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0270.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0270.669] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0270.669] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0270.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0270.669] lstrlenW (lpString="wuauserv") returned 8 [0270.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0270.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0270.669] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0270.669] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0270.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0270.669] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0270.670] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0270.672] Process32FirstW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.672] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.673] lstrlenW (lpString="System") returned 6 [0270.673] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0270.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0270.673] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0270.673] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0270.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0270.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0270.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0270.673] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.674] lstrlenW (lpString="smss.exe") returned 8 [0270.674] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0270.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0270.674] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.675] lstrlenW (lpString="csrss.exe") returned 9 [0270.675] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.675] lstrlenW (lpString="wininit.exe") returned 11 [0270.675] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.676] lstrlenW (lpString="csrss.exe") returned 9 [0270.676] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.677] lstrlenW (lpString="winlogon.exe") returned 12 [0270.677] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.677] lstrlenW (lpString="services.exe") returned 12 [0270.678] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.678] lstrlenW (lpString="lsass.exe") returned 9 [0270.678] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0270.679] lstrlenW (lpString="lsm.exe") returned 7 [0270.679] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.680] lstrlenW (lpString="svchost.exe") returned 11 [0270.680] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.680] lstrlenW (lpString="svchost.exe") returned 11 [0270.680] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.681] lstrlenW (lpString="svchost.exe") returned 11 [0270.681] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.682] lstrlenW (lpString="svchost.exe") returned 11 [0270.682] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.682] lstrlenW (lpString="svchost.exe") returned 11 [0270.682] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.683] lstrlenW (lpString="audiodg.exe") returned 11 [0270.683] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.684] lstrlenW (lpString="svchost.exe") returned 11 [0270.684] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.685] lstrlenW (lpString="svchost.exe") returned 11 [0270.685] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.685] lstrlenW (lpString="dwm.exe") returned 7 [0270.685] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.686] lstrlenW (lpString="explorer.exe") returned 12 [0270.686] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.687] lstrlenW (lpString="spoolsv.exe") returned 11 [0270.687] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.687] lstrlenW (lpString="taskhost.exe") returned 12 [0270.687] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.688] lstrlenW (lpString="svchost.exe") returned 11 [0270.688] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0270.689] lstrlenW (lpString="taskeng.exe") returned 11 [0270.689] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.690] lstrlenW (lpString="svchost.exe") returned 11 [0270.690] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.690] lstrlenW (lpString="taskhost.exe") returned 12 [0270.690] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0270.691] lstrlenW (lpString="sppsvc.exe") returned 10 [0270.691] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.692] lstrlenW (lpString="svchost.exe") returned 11 [0270.692] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0270.693] lstrlenW (lpString="push nutrition.exe") returned 18 [0270.693] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0270.693] lstrlenW (lpString="procedures.exe") returned 14 [0270.693] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0270.694] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0270.694] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0270.820] lstrlenW (lpString="scanner-discover.exe") returned 20 [0270.820] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0270.821] lstrlenW (lpString="regression healthcare.exe") returned 25 [0270.821] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0270.822] lstrlenW (lpString="apr_zinc.exe") returned 12 [0270.822] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0270.823] lstrlenW (lpString="computer.exe") returned 12 [0270.823] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0270.824] lstrlenW (lpString="importanceweekend.exe") returned 21 [0270.824] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0270.825] lstrlenW (lpString="warm_absolute.exe") returned 17 [0270.825] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0270.826] lstrlenW (lpString="funding_editing.exe") returned 19 [0270.826] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0270.827] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0270.827] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0270.828] lstrlenW (lpString="friend.exe") returned 10 [0270.828] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0270.829] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0270.829] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0270.830] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0270.830] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0270.830] lstrlenW (lpString="individually_antiques.exe") returned 25 [0270.830] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0270.831] lstrlenW (lpString="embedded.exe") returned 12 [0270.831] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0270.832] lstrlenW (lpString="usually.exe") returned 11 [0270.832] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0270.833] lstrlenW (lpString="bills.exe") returned 9 [0270.833] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0270.834] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0270.834] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0270.843] lstrlenW (lpString="terminal.exe") returned 12 [0270.843] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0270.844] lstrlenW (lpString="ol_refers.exe") returned 13 [0270.844] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0270.845] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0270.845] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0270.846] lstrlenW (lpString="riding analyst.exe") returned 18 [0270.846] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0270.847] lstrlenW (lpString="robots.exe") returned 10 [0270.847] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0270.848] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0270.848] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0270.849] lstrlenW (lpString="expIorer32.exe") returned 14 [0270.849] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0270.849] lstrlenW (lpString="cmd.exe") returned 7 [0270.849] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0270.850] lstrlenW (lpString="conhost.exe") returned 11 [0270.850] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0270.851] lstrlenW (lpString="vssadmin.exe") returned 12 [0270.851] Process32NextW (in: hSnapshot=0x174, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0270.852] CloseHandle (hObject=0x174) returned 1 [0270.852] Sleep (dwMilliseconds=0x1f4) [0271.609] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0271.610] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0271.610] GetLastError () returned 0xea [0271.610] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0271.610] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0271.611] CloseServiceHandle (hSCObject=0x360140) returned 1 [0271.611] lstrlenW (lpString="Appinfo") returned 7 [0271.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.611] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.611] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.611] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.611] lstrlenW (lpString="AudioSrv") returned 8 [0271.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0271.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0271.611] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0271.611] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0271.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0271.611] lstrlenW (lpString="BFE") returned 3 [0271.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.611] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.611] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.611] lstrlenW (lpString="CryptSvc") returned 8 [0271.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.611] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.611] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.611] lstrlenW (lpString="CscService") returned 10 [0271.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0271.612] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0271.612] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0271.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0271.612] lstrlenW (lpString="DcomLaunch") returned 10 [0271.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.612] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.612] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.612] lstrlenW (lpString="Dhcp") returned 4 [0271.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.612] lstrlenW (lpString="Dnscache") returned 8 [0271.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.612] lstrlenW (lpString="DPS") returned 3 [0271.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.612] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.612] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.612] lstrlenW (lpString="eventlog") returned 8 [0271.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0271.612] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0271.612] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0271.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0271.612] lstrlenW (lpString="EventSystem") returned 11 [0271.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.613] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.613] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.613] lstrlenW (lpString="FontCache") returned 9 [0271.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0271.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0271.613] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0271.613] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0271.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0271.613] lstrlenW (lpString="gpsvc") returned 5 [0271.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.613] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.613] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.613] lstrlenW (lpString="iphlpsvc") returned 8 [0271.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.613] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.613] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.613] lstrlenW (lpString="LanmanServer") returned 12 [0271.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.613] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.613] lstrlenW (lpString="lmhosts") returned 7 [0271.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.614] lstrlenW (lpString="MMCSS") returned 5 [0271.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0271.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0271.614] lstrlenW (lpString="MpsSvc") returned 6 [0271.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.614] lstrlenW (lpString="Netman") returned 6 [0271.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0271.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0271.614] lstrlenW (lpString="netprofm") returned 8 [0271.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.614] lstrlenW (lpString="NlaSvc") returned 6 [0271.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.614] lstrlenW (lpString="nsi") returned 3 [0271.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.614] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.614] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.615] lstrlenW (lpString="PcaSvc") returned 6 [0271.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.615] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.615] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.615] lstrlenW (lpString="PlugPlay") returned 8 [0271.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.615] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.615] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.615] lstrlenW (lpString="Power") returned 5 [0271.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.615] lstrlenW (lpString="ProfSvc") returned 7 [0271.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.615] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.615] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.615] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.615] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.615] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.616] lstrlenW (lpString="RpcSs") returned 5 [0271.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.616] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.616] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.616] lstrlenW (lpString="SamSs") returned 5 [0271.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.616] lstrlenW (lpString="Schedule") returned 8 [0271.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.616] lstrlenW (lpString="SENS") returned 4 [0271.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.616] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.616] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.616] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.616] lstrlenW (lpString="Spooler") returned 7 [0271.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.616] lstrlenW (lpString="sppsvc") returned 6 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0271.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0271.617] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0271.617] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0271.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0271.617] lstrlenW (lpString="SysMain") returned 7 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.617] lstrlenW (lpString="Themes") returned 6 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0271.617] lstrlenW (lpString="TrkWks") returned 6 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0271.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0271.617] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0271.617] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0271.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0271.617] lstrlenW (lpString="UxSms") returned 5 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0271.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0271.617] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0271.617] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0271.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0271.617] lstrlenW (lpString="VSS") returned 3 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0271.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0271.617] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0271.617] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0271.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0271.617] lstrlenW (lpString="WdiServiceHost") returned 14 [0271.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.618] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0271.618] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0271.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0271.618] lstrlenW (lpString="WdiSystemHost") returned 13 [0271.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.618] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0271.618] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0271.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0271.618] lstrlenW (lpString="WinDefend") returned 9 [0271.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0271.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0271.618] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0271.618] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0271.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0271.618] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0271.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.618] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0271.618] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0271.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0271.618] lstrlenW (lpString="Winmgmt") returned 7 [0271.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0271.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0271.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0271.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0271.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0271.618] lstrlenW (lpString="wscsvc") returned 6 [0271.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0271.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0271.618] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0271.618] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0271.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0271.618] lstrlenW (lpString="wuauserv") returned 8 [0271.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0271.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0271.619] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0271.619] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0271.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0271.619] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0271.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0271.621] Process32FirstW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.622] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.622] lstrlenW (lpString="System") returned 6 [0271.622] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0271.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0271.622] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0271.622] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0271.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0271.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0271.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0271.622] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.623] lstrlenW (lpString="smss.exe") returned 8 [0271.623] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0271.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0271.623] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.624] lstrlenW (lpString="csrss.exe") returned 9 [0271.624] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.625] lstrlenW (lpString="wininit.exe") returned 11 [0271.625] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.625] lstrlenW (lpString="csrss.exe") returned 9 [0271.625] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.626] lstrlenW (lpString="winlogon.exe") returned 12 [0271.626] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.627] lstrlenW (lpString="services.exe") returned 12 [0271.627] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.627] lstrlenW (lpString="lsass.exe") returned 9 [0271.628] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.628] lstrlenW (lpString="lsm.exe") returned 7 [0271.628] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.629] lstrlenW (lpString="svchost.exe") returned 11 [0271.629] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.630] lstrlenW (lpString="svchost.exe") returned 11 [0271.630] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.630] lstrlenW (lpString="svchost.exe") returned 11 [0271.630] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.631] lstrlenW (lpString="svchost.exe") returned 11 [0271.631] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.632] lstrlenW (lpString="svchost.exe") returned 11 [0271.632] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.632] lstrlenW (lpString="audiodg.exe") returned 11 [0271.633] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.633] lstrlenW (lpString="svchost.exe") returned 11 [0271.633] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.634] lstrlenW (lpString="svchost.exe") returned 11 [0271.634] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.635] lstrlenW (lpString="dwm.exe") returned 7 [0271.635] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.635] lstrlenW (lpString="explorer.exe") returned 12 [0271.635] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.636] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.636] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.637] lstrlenW (lpString="taskhost.exe") returned 12 [0271.637] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.638] lstrlenW (lpString="svchost.exe") returned 11 [0271.638] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0271.638] lstrlenW (lpString="taskeng.exe") returned 11 [0271.639] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.639] lstrlenW (lpString="svchost.exe") returned 11 [0271.640] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.640] lstrlenW (lpString="taskhost.exe") returned 12 [0271.640] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0271.641] lstrlenW (lpString="sppsvc.exe") returned 10 [0271.641] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.642] lstrlenW (lpString="svchost.exe") returned 11 [0271.642] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0271.642] lstrlenW (lpString="push nutrition.exe") returned 18 [0271.642] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0271.643] lstrlenW (lpString="procedures.exe") returned 14 [0271.643] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0271.644] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0271.644] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0271.644] lstrlenW (lpString="scanner-discover.exe") returned 20 [0271.644] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0271.645] lstrlenW (lpString="regression healthcare.exe") returned 25 [0271.645] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0271.646] lstrlenW (lpString="apr_zinc.exe") returned 12 [0271.646] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0271.816] lstrlenW (lpString="computer.exe") returned 12 [0271.816] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0271.817] lstrlenW (lpString="importanceweekend.exe") returned 21 [0271.817] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0271.818] lstrlenW (lpString="warm_absolute.exe") returned 17 [0271.818] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0271.819] lstrlenW (lpString="funding_editing.exe") returned 19 [0271.819] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0271.820] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0271.820] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0271.821] lstrlenW (lpString="friend.exe") returned 10 [0271.821] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0271.821] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0271.821] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0271.822] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0271.822] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0271.823] lstrlenW (lpString="individually_antiques.exe") returned 25 [0271.823] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0271.823] lstrlenW (lpString="embedded.exe") returned 12 [0271.823] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0271.824] lstrlenW (lpString="usually.exe") returned 11 [0271.824] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0271.825] lstrlenW (lpString="bills.exe") returned 9 [0271.825] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0271.825] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0271.825] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0271.826] lstrlenW (lpString="terminal.exe") returned 12 [0271.826] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0271.827] lstrlenW (lpString="ol_refers.exe") returned 13 [0271.827] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0271.828] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0271.828] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0271.828] lstrlenW (lpString="riding analyst.exe") returned 18 [0271.828] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0271.829] lstrlenW (lpString="robots.exe") returned 10 [0271.829] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0271.830] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0271.830] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0271.830] lstrlenW (lpString="expIorer32.exe") returned 14 [0271.830] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0271.831] lstrlenW (lpString="cmd.exe") returned 7 [0271.831] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0271.832] lstrlenW (lpString="conhost.exe") returned 11 [0271.832] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0271.832] lstrlenW (lpString="vssadmin.exe") returned 12 [0271.832] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0271.833] lstrlenW (lpString="VSSVC.exe") returned 9 [0271.833] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0271.834] CloseHandle (hObject=0x204) returned 1 [0271.834] Sleep (dwMilliseconds=0x1f4) [0272.425] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0272.431] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0272.432] GetLastError () returned 0xea [0272.432] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0272.432] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0272.433] CloseServiceHandle (hSCObject=0x360140) returned 1 [0272.433] lstrlenW (lpString="Appinfo") returned 7 [0272.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0272.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0272.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0272.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0272.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0272.433] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.433] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.433] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.433] lstrlenW (lpString="AudioSrv") returned 8 [0272.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0272.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0272.433] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0272.433] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0272.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0272.433] lstrlenW (lpString="BFE") returned 3 [0272.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.433] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.434] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.434] lstrlenW (lpString="CryptSvc") returned 8 [0272.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.434] lstrlenW (lpString="CscService") returned 10 [0272.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0272.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0272.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0272.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0272.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0272.434] lstrlenW (lpString="DcomLaunch") returned 10 [0272.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.434] lstrlenW (lpString="Dhcp") returned 4 [0272.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.434] lstrlenW (lpString="Dnscache") returned 8 [0272.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.434] lstrlenW (lpString="DPS") returned 3 [0272.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.435] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.435] lstrlenW (lpString="eventlog") returned 8 [0272.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0272.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0272.435] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0272.435] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0272.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0272.435] lstrlenW (lpString="EventSystem") returned 11 [0272.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.435] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.435] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.435] lstrlenW (lpString="FontCache") returned 9 [0272.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0272.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0272.435] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0272.435] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0272.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0272.435] lstrlenW (lpString="gpsvc") returned 5 [0272.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.435] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.435] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.435] lstrlenW (lpString="iphlpsvc") returned 8 [0272.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.435] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.435] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.435] lstrlenW (lpString="LanmanServer") returned 12 [0272.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.436] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.436] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.436] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.436] lstrlenW (lpString="lmhosts") returned 7 [0272.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.436] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.436] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.436] lstrlenW (lpString="MMCSS") returned 5 [0272.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0272.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0272.436] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0272.436] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0272.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0272.436] lstrlenW (lpString="MpsSvc") returned 6 [0272.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.436] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.436] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.436] lstrlenW (lpString="Netman") returned 6 [0272.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0272.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0272.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0272.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0272.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0272.436] lstrlenW (lpString="netprofm") returned 8 [0272.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.436] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.437] lstrlenW (lpString="NlaSvc") returned 6 [0272.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.437] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.437] lstrlenW (lpString="nsi") returned 3 [0272.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.437] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.437] lstrlenW (lpString="PcaSvc") returned 6 [0272.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.437] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.437] lstrlenW (lpString="PlugPlay") returned 8 [0272.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.437] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.437] lstrlenW (lpString="Power") returned 5 [0272.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.437] lstrlenW (lpString="ProfSvc") returned 7 [0272.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.438] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.438] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.438] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.438] lstrlenW (lpString="RpcSs") returned 5 [0272.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.438] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.438] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.438] lstrlenW (lpString="SamSs") returned 5 [0272.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.438] lstrlenW (lpString="Schedule") returned 8 [0272.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.438] lstrlenW (lpString="SENS") returned 4 [0272.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.438] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.438] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.438] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.439] lstrlenW (lpString="Spooler") returned 7 [0272.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.439] lstrlenW (lpString="sppsvc") returned 6 [0272.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0272.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0272.439] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0272.439] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0272.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0272.439] lstrlenW (lpString="SysMain") returned 7 [0272.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.439] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.439] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.439] lstrlenW (lpString="Themes") returned 6 [0272.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.439] lstrlenW (lpString="TrkWks") returned 6 [0272.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0272.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0272.439] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0272.439] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0272.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0272.439] lstrlenW (lpString="UxSms") returned 5 [0272.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0272.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0272.439] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0272.439] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0272.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0272.440] lstrlenW (lpString="VSS") returned 3 [0272.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0272.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0272.440] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0272.440] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0272.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0272.440] lstrlenW (lpString="WdiServiceHost") returned 14 [0272.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0272.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0272.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0272.440] lstrlenW (lpString="WdiSystemHost") returned 13 [0272.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0272.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0272.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0272.440] lstrlenW (lpString="WinDefend") returned 9 [0272.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0272.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0272.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0272.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0272.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0272.440] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0272.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0272.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0272.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0272.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0272.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0272.440] lstrlenW (lpString="Winmgmt") returned 7 [0272.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0272.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0272.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0272.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0272.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0272.441] lstrlenW (lpString="wscsvc") returned 6 [0272.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0272.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0272.441] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0272.441] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0272.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0272.441] lstrlenW (lpString="wuauserv") returned 8 [0272.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0272.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0272.441] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0272.441] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0272.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0272.441] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0272.441] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0272.443] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.444] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.444] lstrlenW (lpString="System") returned 6 [0272.444] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0272.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0272.445] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0272.445] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0272.445] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0272.445] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0272.445] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0272.445] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.445] lstrlenW (lpString="smss.exe") returned 8 [0272.445] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0272.445] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0272.445] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.446] lstrlenW (lpString="csrss.exe") returned 9 [0272.446] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.447] lstrlenW (lpString="wininit.exe") returned 11 [0272.447] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.447] lstrlenW (lpString="csrss.exe") returned 9 [0272.447] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.448] lstrlenW (lpString="winlogon.exe") returned 12 [0272.448] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.449] lstrlenW (lpString="services.exe") returned 12 [0272.449] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.449] lstrlenW (lpString="lsass.exe") returned 9 [0272.449] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.450] lstrlenW (lpString="lsm.exe") returned 7 [0272.450] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.451] lstrlenW (lpString="svchost.exe") returned 11 [0272.451] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.452] lstrlenW (lpString="svchost.exe") returned 11 [0272.452] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.452] lstrlenW (lpString="svchost.exe") returned 11 [0272.452] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.453] lstrlenW (lpString="svchost.exe") returned 11 [0272.453] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.454] lstrlenW (lpString="svchost.exe") returned 11 [0272.454] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.454] lstrlenW (lpString="audiodg.exe") returned 11 [0272.454] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.455] lstrlenW (lpString="svchost.exe") returned 11 [0272.455] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.456] lstrlenW (lpString="svchost.exe") returned 11 [0272.456] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.456] lstrlenW (lpString="dwm.exe") returned 7 [0272.456] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.457] lstrlenW (lpString="explorer.exe") returned 12 [0272.457] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.458] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.458] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.458] lstrlenW (lpString="taskhost.exe") returned 12 [0272.458] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.459] lstrlenW (lpString="svchost.exe") returned 11 [0272.459] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0272.460] lstrlenW (lpString="taskeng.exe") returned 11 [0272.460] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.460] lstrlenW (lpString="svchost.exe") returned 11 [0272.460] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.461] lstrlenW (lpString="taskhost.exe") returned 12 [0272.461] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0272.462] lstrlenW (lpString="sppsvc.exe") returned 10 [0272.462] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.462] lstrlenW (lpString="svchost.exe") returned 11 [0272.462] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0272.463] lstrlenW (lpString="push nutrition.exe") returned 18 [0272.463] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0272.464] lstrlenW (lpString="procedures.exe") returned 14 [0272.464] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0272.464] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0272.464] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0272.465] lstrlenW (lpString="scanner-discover.exe") returned 20 [0272.465] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0272.466] lstrlenW (lpString="regression healthcare.exe") returned 25 [0272.466] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0272.466] lstrlenW (lpString="apr_zinc.exe") returned 12 [0272.466] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0272.467] lstrlenW (lpString="computer.exe") returned 12 [0272.467] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0272.468] lstrlenW (lpString="importanceweekend.exe") returned 21 [0272.468] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0272.468] lstrlenW (lpString="warm_absolute.exe") returned 17 [0272.468] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0272.469] lstrlenW (lpString="funding_editing.exe") returned 19 [0272.469] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0272.470] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0272.470] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0272.470] lstrlenW (lpString="friend.exe") returned 10 [0272.470] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0272.471] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0272.471] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0272.472] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0272.472] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0272.472] lstrlenW (lpString="individually_antiques.exe") returned 25 [0272.472] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0272.504] lstrlenW (lpString="embedded.exe") returned 12 [0272.504] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0272.505] lstrlenW (lpString="usually.exe") returned 11 [0272.505] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0272.505] lstrlenW (lpString="bills.exe") returned 9 [0272.505] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0272.506] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0272.506] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0272.507] lstrlenW (lpString="terminal.exe") returned 12 [0272.507] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0272.507] lstrlenW (lpString="ol_refers.exe") returned 13 [0272.508] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0272.508] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0272.508] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0272.509] lstrlenW (lpString="riding analyst.exe") returned 18 [0272.509] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0272.510] lstrlenW (lpString="robots.exe") returned 10 [0272.510] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0272.510] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0272.510] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0272.511] lstrlenW (lpString="expIorer32.exe") returned 14 [0272.511] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0272.512] lstrlenW (lpString="cmd.exe") returned 7 [0272.512] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0272.512] lstrlenW (lpString="conhost.exe") returned 11 [0272.512] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0272.513] lstrlenW (lpString="vssadmin.exe") returned 12 [0272.513] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0272.514] lstrlenW (lpString="VSSVC.exe") returned 9 [0272.514] Process32NextW (in: hSnapshot=0x1f4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0272.514] CloseHandle (hObject=0x1f4) returned 1 [0272.514] Sleep (dwMilliseconds=0x1f4) [0273.028] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0273.029] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0273.029] GetLastError () returned 0xea [0273.029] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0273.029] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0273.029] CloseServiceHandle (hSCObject=0x360140) returned 1 [0273.029] lstrlenW (lpString="Appinfo") returned 7 [0273.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.030] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.030] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.030] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.030] lstrlenW (lpString="AudioSrv") returned 8 [0273.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0273.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0273.030] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0273.030] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0273.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0273.030] lstrlenW (lpString="BFE") returned 3 [0273.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.030] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.030] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.030] lstrlenW (lpString="CryptSvc") returned 8 [0273.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.031] lstrlenW (lpString="CscService") returned 10 [0273.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0273.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0273.031] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0273.031] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0273.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0273.031] lstrlenW (lpString="DcomLaunch") returned 10 [0273.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.031] lstrlenW (lpString="Dhcp") returned 4 [0273.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.031] lstrlenW (lpString="Dnscache") returned 8 [0273.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.031] lstrlenW (lpString="DPS") returned 3 [0273.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.032] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.032] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.032] lstrlenW (lpString="eventlog") returned 8 [0273.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0273.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0273.032] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0273.032] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0273.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0273.032] lstrlenW (lpString="EventSystem") returned 11 [0273.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.032] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.032] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.032] lstrlenW (lpString="FontCache") returned 9 [0273.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.032] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.032] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.032] lstrlenW (lpString="gpsvc") returned 5 [0273.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.032] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.032] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.032] lstrlenW (lpString="iphlpsvc") returned 8 [0273.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.033] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.033] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.033] lstrlenW (lpString="LanmanServer") returned 12 [0273.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.033] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.033] lstrlenW (lpString="lmhosts") returned 7 [0273.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.033] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.033] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.033] lstrlenW (lpString="MMCSS") returned 5 [0273.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0273.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0273.033] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0273.033] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0273.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0273.033] lstrlenW (lpString="MpsSvc") returned 6 [0273.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.034] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.034] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.034] lstrlenW (lpString="Netman") returned 6 [0273.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0273.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0273.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0273.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0273.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0273.034] lstrlenW (lpString="netprofm") returned 8 [0273.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.034] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.034] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.034] lstrlenW (lpString="NlaSvc") returned 6 [0273.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.034] lstrlenW (lpString="nsi") returned 3 [0273.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.034] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.034] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.034] lstrlenW (lpString="PcaSvc") returned 6 [0273.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.035] lstrlenW (lpString="PlugPlay") returned 8 [0273.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.035] lstrlenW (lpString="Power") returned 5 [0273.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.035] lstrlenW (lpString="ProfSvc") returned 7 [0273.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.035] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.035] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.035] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.035] lstrlenW (lpString="RpcSs") returned 5 [0273.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.036] lstrlenW (lpString="SamSs") returned 5 [0273.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.036] lstrlenW (lpString="Schedule") returned 8 [0273.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.036] lstrlenW (lpString="SENS") returned 4 [0273.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.036] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.036] lstrlenW (lpString="Spooler") returned 7 [0273.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.037] lstrlenW (lpString="sppsvc") returned 6 [0273.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0273.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0273.037] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0273.037] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0273.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0273.037] lstrlenW (lpString="SysMain") returned 7 [0273.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.037] lstrlenW (lpString="Themes") returned 6 [0273.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.037] lstrlenW (lpString="TrkWks") returned 6 [0273.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0273.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0273.037] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0273.037] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0273.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0273.037] lstrlenW (lpString="UxSms") returned 5 [0273.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0273.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0273.037] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0273.037] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0273.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0273.037] lstrlenW (lpString="VSS") returned 3 [0273.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0273.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0273.038] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0273.038] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0273.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0273.038] lstrlenW (lpString="WdiServiceHost") returned 14 [0273.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.038] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0273.038] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0273.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0273.038] lstrlenW (lpString="WdiSystemHost") returned 13 [0273.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.038] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0273.038] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0273.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0273.038] lstrlenW (lpString="WinDefend") returned 9 [0273.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0273.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0273.038] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0273.038] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0273.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0273.038] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0273.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.038] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0273.038] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0273.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0273.038] lstrlenW (lpString="Winmgmt") returned 7 [0273.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0273.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0273.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0273.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0273.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0273.039] lstrlenW (lpString="wscsvc") returned 6 [0273.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0273.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0273.039] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0273.039] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0273.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0273.039] lstrlenW (lpString="wuauserv") returned 8 [0273.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0273.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0273.039] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0273.039] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0273.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0273.039] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0273.039] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0273.041] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.042] lstrlenW (lpString="System") returned 6 [0273.042] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0273.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0273.042] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0273.042] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0273.042] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0273.042] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0273.043] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0273.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.043] lstrlenW (lpString="smss.exe") returned 8 [0273.043] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0273.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0273.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.044] lstrlenW (lpString="csrss.exe") returned 9 [0273.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.045] lstrlenW (lpString="wininit.exe") returned 11 [0273.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.045] lstrlenW (lpString="csrss.exe") returned 9 [0273.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.046] lstrlenW (lpString="winlogon.exe") returned 12 [0273.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.047] lstrlenW (lpString="services.exe") returned 12 [0273.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.048] lstrlenW (lpString="lsass.exe") returned 9 [0273.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.048] lstrlenW (lpString="lsm.exe") returned 7 [0273.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.049] lstrlenW (lpString="svchost.exe") returned 11 [0273.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.050] lstrlenW (lpString="svchost.exe") returned 11 [0273.050] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.051] lstrlenW (lpString="svchost.exe") returned 11 [0273.051] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.052] lstrlenW (lpString="svchost.exe") returned 11 [0273.052] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.053] lstrlenW (lpString="svchost.exe") returned 11 [0273.053] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.054] lstrlenW (lpString="audiodg.exe") returned 11 [0273.054] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.054] lstrlenW (lpString="svchost.exe") returned 11 [0273.054] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.055] lstrlenW (lpString="svchost.exe") returned 11 [0273.055] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.056] lstrlenW (lpString="dwm.exe") returned 7 [0273.056] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.056] lstrlenW (lpString="explorer.exe") returned 12 [0273.057] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.057] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.057] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.058] lstrlenW (lpString="taskhost.exe") returned 12 [0273.058] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.059] lstrlenW (lpString="svchost.exe") returned 11 [0273.059] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0273.059] lstrlenW (lpString="taskeng.exe") returned 11 [0273.059] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.060] lstrlenW (lpString="svchost.exe") returned 11 [0273.060] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.061] lstrlenW (lpString="taskhost.exe") returned 12 [0273.061] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0273.061] lstrlenW (lpString="sppsvc.exe") returned 10 [0273.061] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.062] lstrlenW (lpString="svchost.exe") returned 11 [0273.062] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0273.063] lstrlenW (lpString="push nutrition.exe") returned 18 [0273.063] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0273.063] lstrlenW (lpString="procedures.exe") returned 14 [0273.063] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0273.064] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0273.064] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0273.065] lstrlenW (lpString="scanner-discover.exe") returned 20 [0273.065] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0273.065] lstrlenW (lpString="regression healthcare.exe") returned 25 [0273.065] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0273.066] lstrlenW (lpString="apr_zinc.exe") returned 12 [0273.066] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0273.067] lstrlenW (lpString="computer.exe") returned 12 [0273.067] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0273.068] lstrlenW (lpString="importanceweekend.exe") returned 21 [0273.068] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0273.068] lstrlenW (lpString="warm_absolute.exe") returned 17 [0273.068] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0273.069] lstrlenW (lpString="funding_editing.exe") returned 19 [0273.069] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0273.070] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0273.070] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0273.070] lstrlenW (lpString="friend.exe") returned 10 [0273.071] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0273.071] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0273.071] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0273.072] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0273.072] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0273.073] lstrlenW (lpString="individually_antiques.exe") returned 25 [0273.073] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0273.073] lstrlenW (lpString="embedded.exe") returned 12 [0273.073] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0273.074] lstrlenW (lpString="usually.exe") returned 11 [0273.074] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0273.075] lstrlenW (lpString="bills.exe") returned 9 [0273.075] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0273.075] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0273.075] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0273.076] lstrlenW (lpString="terminal.exe") returned 12 [0273.076] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0273.077] lstrlenW (lpString="ol_refers.exe") returned 13 [0273.077] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0273.077] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0273.077] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0273.078] lstrlenW (lpString="riding analyst.exe") returned 18 [0273.078] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0273.079] lstrlenW (lpString="robots.exe") returned 10 [0273.079] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.079] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.079] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0273.080] lstrlenW (lpString="expIorer32.exe") returned 14 [0273.080] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.081] lstrlenW (lpString="cmd.exe") returned 7 [0273.081] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.081] lstrlenW (lpString="conhost.exe") returned 11 [0273.081] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0273.082] lstrlenW (lpString="vssadmin.exe") returned 12 [0273.082] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0273.083] lstrlenW (lpString="VSSVC.exe") returned 9 [0273.083] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0273.083] CloseHandle (hObject=0x1b0) returned 1 [0273.084] Sleep (dwMilliseconds=0x1f4) [0273.597] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0273.597] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0273.597] GetLastError () returned 0xea [0273.597] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0273.597] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0273.598] CloseServiceHandle (hSCObject=0x360140) returned 1 [0273.598] lstrlenW (lpString="Appinfo") returned 7 [0273.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.598] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.598] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.598] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.599] lstrlenW (lpString="AudioSrv") returned 8 [0273.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0273.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0273.599] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0273.599] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0273.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0273.599] lstrlenW (lpString="BFE") returned 3 [0273.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.599] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.599] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.599] lstrlenW (lpString="CryptSvc") returned 8 [0273.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.599] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.599] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.599] lstrlenW (lpString="CscService") returned 10 [0273.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0273.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0273.599] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0273.599] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0273.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0273.599] lstrlenW (lpString="DcomLaunch") returned 10 [0273.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.600] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.600] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.600] lstrlenW (lpString="Dhcp") returned 4 [0273.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.600] lstrlenW (lpString="Dnscache") returned 8 [0273.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.600] lstrlenW (lpString="DPS") returned 3 [0273.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.600] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.600] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.600] lstrlenW (lpString="eventlog") returned 8 [0273.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0273.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0273.600] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0273.600] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0273.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0273.601] lstrlenW (lpString="EventSystem") returned 11 [0273.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.601] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.601] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.601] lstrlenW (lpString="FontCache") returned 9 [0273.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0273.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0273.601] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0273.601] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0273.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0273.601] lstrlenW (lpString="gpsvc") returned 5 [0273.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.601] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.601] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.601] lstrlenW (lpString="iphlpsvc") returned 8 [0273.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.601] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.601] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.601] lstrlenW (lpString="LanmanServer") returned 12 [0273.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.602] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.602] lstrlenW (lpString="lmhosts") returned 7 [0273.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.602] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.602] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.602] lstrlenW (lpString="MMCSS") returned 5 [0273.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0273.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0273.602] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0273.602] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0273.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0273.602] lstrlenW (lpString="MpsSvc") returned 6 [0273.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.602] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.602] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.602] lstrlenW (lpString="Netman") returned 6 [0273.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0273.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0273.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0273.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0273.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0273.603] lstrlenW (lpString="netprofm") returned 8 [0273.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.603] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.603] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.603] lstrlenW (lpString="NlaSvc") returned 6 [0273.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.603] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.603] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.603] lstrlenW (lpString="nsi") returned 3 [0273.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.603] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.603] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.603] lstrlenW (lpString="PcaSvc") returned 6 [0273.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.603] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.604] lstrlenW (lpString="PlugPlay") returned 8 [0273.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.604] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.604] lstrlenW (lpString="Power") returned 5 [0273.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.604] lstrlenW (lpString="ProfSvc") returned 7 [0273.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.604] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.604] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.604] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.604] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.604] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.604] lstrlenW (lpString="RpcSs") returned 5 [0273.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.605] lstrlenW (lpString="SamSs") returned 5 [0273.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.605] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.605] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.605] lstrlenW (lpString="Schedule") returned 8 [0273.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.605] lstrlenW (lpString="SENS") returned 4 [0273.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.605] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.605] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.605] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.606] lstrlenW (lpString="Spooler") returned 7 [0273.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.606] lstrlenW (lpString="sppsvc") returned 6 [0273.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0273.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0273.606] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0273.606] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0273.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0273.606] lstrlenW (lpString="SysMain") returned 7 [0273.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.606] lstrlenW (lpString="Themes") returned 6 [0273.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.606] lstrlenW (lpString="TrkWks") returned 6 [0273.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0273.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0273.607] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0273.607] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0273.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0273.607] lstrlenW (lpString="UxSms") returned 5 [0273.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0273.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0273.607] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0273.607] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0273.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0273.607] lstrlenW (lpString="VSS") returned 3 [0273.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0273.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0273.607] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0273.607] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0273.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0273.607] lstrlenW (lpString="WdiServiceHost") returned 14 [0273.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.607] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0273.607] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0273.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0273.607] lstrlenW (lpString="WdiSystemHost") returned 13 [0273.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.607] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0273.607] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0273.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0273.608] lstrlenW (lpString="WinDefend") returned 9 [0273.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0273.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0273.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0273.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0273.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0273.608] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0273.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0273.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0273.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0273.608] lstrlenW (lpString="Winmgmt") returned 7 [0273.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0273.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0273.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0273.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0273.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0273.608] lstrlenW (lpString="wscsvc") returned 6 [0273.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0273.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0273.608] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0273.608] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0273.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0273.608] lstrlenW (lpString="wuauserv") returned 8 [0273.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0273.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0273.609] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0273.609] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0273.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0273.609] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0273.609] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0273.611] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.612] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.613] lstrlenW (lpString="System") returned 6 [0273.613] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0273.613] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0273.613] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0273.613] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0273.613] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0273.613] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0273.613] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0273.613] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.614] lstrlenW (lpString="smss.exe") returned 8 [0273.614] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0273.614] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0273.614] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.615] lstrlenW (lpString="csrss.exe") returned 9 [0273.615] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.616] lstrlenW (lpString="wininit.exe") returned 11 [0273.616] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.617] lstrlenW (lpString="csrss.exe") returned 9 [0273.617] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.618] lstrlenW (lpString="winlogon.exe") returned 12 [0273.618] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.619] lstrlenW (lpString="services.exe") returned 12 [0273.619] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.620] lstrlenW (lpString="lsass.exe") returned 9 [0273.620] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.620] lstrlenW (lpString="lsm.exe") returned 7 [0273.620] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.621] lstrlenW (lpString="svchost.exe") returned 11 [0273.621] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.622] lstrlenW (lpString="svchost.exe") returned 11 [0273.622] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.623] lstrlenW (lpString="svchost.exe") returned 11 [0273.623] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.624] lstrlenW (lpString="svchost.exe") returned 11 [0273.624] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.625] lstrlenW (lpString="svchost.exe") returned 11 [0273.625] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.626] lstrlenW (lpString="audiodg.exe") returned 11 [0273.626] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.627] lstrlenW (lpString="svchost.exe") returned 11 [0273.627] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.628] lstrlenW (lpString="svchost.exe") returned 11 [0273.628] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.629] lstrlenW (lpString="dwm.exe") returned 7 [0273.629] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.629] lstrlenW (lpString="explorer.exe") returned 12 [0273.630] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.630] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.630] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.631] lstrlenW (lpString="taskhost.exe") returned 12 [0273.631] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.632] lstrlenW (lpString="svchost.exe") returned 11 [0273.632] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0273.633] lstrlenW (lpString="taskeng.exe") returned 11 [0273.633] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.634] lstrlenW (lpString="svchost.exe") returned 11 [0273.634] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.635] lstrlenW (lpString="taskhost.exe") returned 12 [0273.635] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0273.636] lstrlenW (lpString="sppsvc.exe") returned 10 [0273.636] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.637] lstrlenW (lpString="svchost.exe") returned 11 [0273.637] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0273.637] lstrlenW (lpString="push nutrition.exe") returned 18 [0273.638] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0273.638] lstrlenW (lpString="procedures.exe") returned 14 [0273.638] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0273.639] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0273.639] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0273.640] lstrlenW (lpString="scanner-discover.exe") returned 20 [0273.640] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0273.641] lstrlenW (lpString="regression healthcare.exe") returned 25 [0273.641] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0273.642] lstrlenW (lpString="apr_zinc.exe") returned 12 [0273.642] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0273.643] lstrlenW (lpString="computer.exe") returned 12 [0273.643] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0273.644] lstrlenW (lpString="importanceweekend.exe") returned 21 [0273.644] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0273.645] lstrlenW (lpString="warm_absolute.exe") returned 17 [0273.645] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0273.646] lstrlenW (lpString="funding_editing.exe") returned 19 [0273.646] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0273.647] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0273.647] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0273.648] lstrlenW (lpString="friend.exe") returned 10 [0273.648] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0273.649] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0273.649] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0273.650] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0273.650] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0273.651] lstrlenW (lpString="individually_antiques.exe") returned 25 [0273.651] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0273.652] lstrlenW (lpString="embedded.exe") returned 12 [0273.652] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0273.652] lstrlenW (lpString="usually.exe") returned 11 [0273.652] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0273.653] lstrlenW (lpString="bills.exe") returned 9 [0273.653] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0273.654] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0273.654] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0273.655] lstrlenW (lpString="terminal.exe") returned 12 [0273.655] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0273.656] lstrlenW (lpString="ol_refers.exe") returned 13 [0273.656] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0273.657] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0273.657] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0273.658] lstrlenW (lpString="riding analyst.exe") returned 18 [0273.658] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0273.659] lstrlenW (lpString="robots.exe") returned 10 [0273.659] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0273.660] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0273.660] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0273.661] lstrlenW (lpString="expIorer32.exe") returned 14 [0273.661] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.662] lstrlenW (lpString="cmd.exe") returned 7 [0273.662] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.663] lstrlenW (lpString="conhost.exe") returned 11 [0273.663] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0273.663] lstrlenW (lpString="vssadmin.exe") returned 12 [0273.664] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0273.664] lstrlenW (lpString="VSSVC.exe") returned 9 [0273.664] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0273.665] CloseHandle (hObject=0x1e0) returned 1 [0273.665] Sleep (dwMilliseconds=0x1f4) [0274.179] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0274.179] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0274.179] GetLastError () returned 0xea [0274.179] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0274.179] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0274.180] CloseServiceHandle (hSCObject=0x360140) returned 1 [0274.180] lstrlenW (lpString="Appinfo") returned 7 [0274.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0274.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0274.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0274.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0274.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0274.180] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.180] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.180] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.181] lstrlenW (lpString="AudioSrv") returned 8 [0274.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0274.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0274.181] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0274.181] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0274.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0274.181] lstrlenW (lpString="BFE") returned 3 [0274.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.181] lstrlenW (lpString="CryptSvc") returned 8 [0274.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.181] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.181] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.181] lstrlenW (lpString="CscService") returned 10 [0274.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0274.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0274.181] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0274.181] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0274.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0274.181] lstrlenW (lpString="DcomLaunch") returned 10 [0274.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.182] lstrlenW (lpString="Dhcp") returned 4 [0274.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.182] lstrlenW (lpString="Dnscache") returned 8 [0274.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.182] lstrlenW (lpString="DPS") returned 3 [0274.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.182] lstrlenW (lpString="eventlog") returned 8 [0274.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0274.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0274.182] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0274.182] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0274.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0274.182] lstrlenW (lpString="EventSystem") returned 11 [0274.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.183] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.183] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.183] lstrlenW (lpString="FontCache") returned 9 [0274.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0274.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0274.183] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0274.183] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0274.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0274.183] lstrlenW (lpString="gpsvc") returned 5 [0274.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.183] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.183] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.183] lstrlenW (lpString="iphlpsvc") returned 8 [0274.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.183] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0274.183] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0274.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0274.183] lstrlenW (lpString="LanmanServer") returned 12 [0274.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0274.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0274.183] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0274.183] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0274.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0274.184] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.184] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.184] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.184] lstrlenW (lpString="lmhosts") returned 7 [0274.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.184] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.184] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.184] lstrlenW (lpString="MMCSS") returned 5 [0274.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0274.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0274.184] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0274.184] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0274.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0274.184] lstrlenW (lpString="MpsSvc") returned 6 [0274.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.184] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.184] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.184] lstrlenW (lpString="Netman") returned 6 [0274.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0274.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0274.185] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0274.185] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0274.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0274.185] lstrlenW (lpString="netprofm") returned 8 [0274.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0274.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0274.185] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0274.185] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0274.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0274.185] lstrlenW (lpString="NlaSvc") returned 6 [0274.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.185] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.185] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.185] lstrlenW (lpString="nsi") returned 3 [0274.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.185] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.185] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.185] lstrlenW (lpString="PcaSvc") returned 6 [0274.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.185] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.185] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.186] lstrlenW (lpString="PlugPlay") returned 8 [0274.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.186] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.186] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.186] lstrlenW (lpString="Power") returned 5 [0274.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.186] lstrlenW (lpString="ProfSvc") returned 7 [0274.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.186] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.186] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.186] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.186] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.186] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.186] lstrlenW (lpString="RpcSs") returned 5 [0274.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.186] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.187] lstrlenW (lpString="SamSs") returned 5 [0274.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.187] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.187] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.187] lstrlenW (lpString="Schedule") returned 8 [0274.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.187] lstrlenW (lpString="SENS") returned 4 [0274.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.187] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.187] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.187] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.187] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.187] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.187] lstrlenW (lpString="Spooler") returned 7 [0274.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.188] lstrlenW (lpString="sppsvc") returned 6 [0274.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0274.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0274.188] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0274.188] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0274.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0274.188] lstrlenW (lpString="SysMain") returned 7 [0274.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0274.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0274.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0274.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0274.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0274.188] lstrlenW (lpString="Themes") returned 6 [0274.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0274.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0274.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0274.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0274.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0274.188] lstrlenW (lpString="TrkWks") returned 6 [0274.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0274.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0274.188] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0274.188] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0274.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0274.189] lstrlenW (lpString="UxSms") returned 5 [0274.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0274.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0274.189] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0274.189] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0274.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0274.189] lstrlenW (lpString="VSS") returned 3 [0274.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0274.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0274.189] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0274.189] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0274.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0274.189] lstrlenW (lpString="WdiServiceHost") returned 14 [0274.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0274.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0274.189] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0274.189] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0274.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0274.189] lstrlenW (lpString="WdiSystemHost") returned 13 [0274.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0274.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0274.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0274.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0274.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0274.190] lstrlenW (lpString="WinDefend") returned 9 [0274.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0274.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0274.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0274.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0274.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0274.190] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0274.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0274.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0274.190] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0274.190] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0274.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0274.190] lstrlenW (lpString="Winmgmt") returned 7 [0274.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0274.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0274.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0274.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0274.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0274.190] lstrlenW (lpString="wscsvc") returned 6 [0274.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0274.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0274.190] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0274.190] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0274.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0274.191] lstrlenW (lpString="wuauserv") returned 8 [0274.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0274.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0274.191] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0274.191] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0274.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0274.191] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0274.191] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0274.193] Process32FirstW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.194] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.195] lstrlenW (lpString="System") returned 6 [0274.195] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0274.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0274.195] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0274.195] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0274.195] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0274.195] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0274.195] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0274.195] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.196] lstrlenW (lpString="smss.exe") returned 8 [0274.196] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0274.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0274.196] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.197] lstrlenW (lpString="csrss.exe") returned 9 [0274.197] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.198] lstrlenW (lpString="wininit.exe") returned 11 [0274.198] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.199] lstrlenW (lpString="csrss.exe") returned 9 [0274.199] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.200] lstrlenW (lpString="winlogon.exe") returned 12 [0274.200] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.201] lstrlenW (lpString="services.exe") returned 12 [0274.201] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.202] lstrlenW (lpString="lsass.exe") returned 9 [0274.202] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.203] lstrlenW (lpString="lsm.exe") returned 7 [0274.203] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.204] lstrlenW (lpString="svchost.exe") returned 11 [0274.204] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.205] lstrlenW (lpString="svchost.exe") returned 11 [0274.205] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.206] lstrlenW (lpString="svchost.exe") returned 11 [0274.206] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.207] lstrlenW (lpString="svchost.exe") returned 11 [0274.207] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.208] lstrlenW (lpString="svchost.exe") returned 11 [0274.208] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.209] lstrlenW (lpString="audiodg.exe") returned 11 [0274.209] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.210] lstrlenW (lpString="svchost.exe") returned 11 [0274.210] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.211] lstrlenW (lpString="svchost.exe") returned 11 [0274.211] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.212] lstrlenW (lpString="dwm.exe") returned 7 [0274.212] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.213] lstrlenW (lpString="explorer.exe") returned 12 [0274.213] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.213] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.213] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.214] lstrlenW (lpString="taskhost.exe") returned 12 [0274.214] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.215] lstrlenW (lpString="svchost.exe") returned 11 [0274.215] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0274.216] lstrlenW (lpString="taskeng.exe") returned 11 [0274.216] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.217] lstrlenW (lpString="svchost.exe") returned 11 [0274.217] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.218] lstrlenW (lpString="taskhost.exe") returned 12 [0274.218] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0274.219] lstrlenW (lpString="sppsvc.exe") returned 10 [0274.219] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.220] lstrlenW (lpString="svchost.exe") returned 11 [0274.220] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0274.221] lstrlenW (lpString="push nutrition.exe") returned 18 [0274.222] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0274.223] lstrlenW (lpString="procedures.exe") returned 14 [0274.223] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0274.224] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0274.224] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0274.225] lstrlenW (lpString="scanner-discover.exe") returned 20 [0274.225] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0274.226] lstrlenW (lpString="regression healthcare.exe") returned 25 [0274.226] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0274.227] lstrlenW (lpString="apr_zinc.exe") returned 12 [0274.227] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0274.228] lstrlenW (lpString="computer.exe") returned 12 [0274.228] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0274.229] lstrlenW (lpString="importanceweekend.exe") returned 21 [0274.229] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0274.230] lstrlenW (lpString="warm_absolute.exe") returned 17 [0274.230] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0274.230] lstrlenW (lpString="funding_editing.exe") returned 19 [0274.231] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0274.231] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0274.231] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0274.232] lstrlenW (lpString="friend.exe") returned 10 [0274.232] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0274.233] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0274.233] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0274.234] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0274.234] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0274.235] lstrlenW (lpString="individually_antiques.exe") returned 25 [0274.235] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0274.236] lstrlenW (lpString="embedded.exe") returned 12 [0274.236] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0274.237] lstrlenW (lpString="usually.exe") returned 11 [0274.237] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0274.238] lstrlenW (lpString="bills.exe") returned 9 [0274.238] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0274.239] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0274.239] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0274.240] lstrlenW (lpString="terminal.exe") returned 12 [0274.240] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0274.241] lstrlenW (lpString="ol_refers.exe") returned 13 [0274.241] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0274.242] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0274.242] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0274.243] lstrlenW (lpString="riding analyst.exe") returned 18 [0274.243] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0274.244] lstrlenW (lpString="robots.exe") returned 10 [0274.244] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.245] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0274.245] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0274.246] lstrlenW (lpString="expIorer32.exe") returned 14 [0274.246] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0274.247] lstrlenW (lpString="cmd.exe") returned 7 [0274.247] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0274.247] lstrlenW (lpString="conhost.exe") returned 11 [0274.247] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0274.248] lstrlenW (lpString="vssadmin.exe") returned 12 [0274.248] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0274.249] lstrlenW (lpString="VSSVC.exe") returned 9 [0274.249] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0274.250] CloseHandle (hObject=0x204) returned 1 [0274.250] Sleep (dwMilliseconds=0x1f4) [0274.765] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0274.765] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0274.765] GetLastError () returned 0xea [0274.765] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0274.765] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0274.766] CloseServiceHandle (hSCObject=0x360140) returned 1 [0274.766] lstrlenW (lpString="Appinfo") returned 7 [0274.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0274.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0274.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0274.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0274.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0274.766] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.766] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.766] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.766] lstrlenW (lpString="AudioSrv") returned 8 [0274.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0274.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0274.766] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0274.766] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0274.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0274.766] lstrlenW (lpString="BFE") returned 3 [0274.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.767] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.767] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.767] lstrlenW (lpString="CryptSvc") returned 8 [0274.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.767] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.767] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.767] lstrlenW (lpString="CscService") returned 10 [0274.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0274.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0274.767] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0274.767] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0274.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0274.767] lstrlenW (lpString="DcomLaunch") returned 10 [0274.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.767] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.767] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.767] lstrlenW (lpString="Dhcp") returned 4 [0274.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.767] lstrlenW (lpString="Dnscache") returned 8 [0274.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.768] lstrlenW (lpString="DPS") returned 3 [0274.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.768] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.768] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.768] lstrlenW (lpString="eventlog") returned 8 [0274.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0274.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0274.768] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0274.768] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0274.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0274.768] lstrlenW (lpString="EventSystem") returned 11 [0274.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.768] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.768] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.768] lstrlenW (lpString="FontCache") returned 9 [0274.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0274.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0274.768] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0274.768] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0274.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0274.768] lstrlenW (lpString="gpsvc") returned 5 [0274.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.769] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.769] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.769] lstrlenW (lpString="iphlpsvc") returned 8 [0274.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.769] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0274.769] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0274.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0274.769] lstrlenW (lpString="LanmanServer") returned 12 [0274.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0274.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0274.769] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0274.769] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0274.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0274.769] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.769] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.769] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.769] lstrlenW (lpString="lmhosts") returned 7 [0274.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.769] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.769] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.769] lstrlenW (lpString="MMCSS") returned 5 [0274.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0274.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0274.769] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0274.769] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0274.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0274.770] lstrlenW (lpString="MpsSvc") returned 6 [0274.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.770] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.770] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.770] lstrlenW (lpString="Netman") returned 6 [0274.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0274.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0274.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0274.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0274.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0274.770] lstrlenW (lpString="netprofm") returned 8 [0274.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0274.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0274.770] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0274.770] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0274.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0274.770] lstrlenW (lpString="NlaSvc") returned 6 [0274.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.770] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.770] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.770] lstrlenW (lpString="nsi") returned 3 [0274.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.770] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.770] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.770] lstrlenW (lpString="PcaSvc") returned 6 [0274.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.770] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.770] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.771] lstrlenW (lpString="PlugPlay") returned 8 [0274.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.771] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.771] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.771] lstrlenW (lpString="Power") returned 5 [0274.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.771] lstrlenW (lpString="ProfSvc") returned 7 [0274.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.771] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.771] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.771] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.771] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.771] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.771] lstrlenW (lpString="RpcSs") returned 5 [0274.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.771] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.771] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.771] lstrlenW (lpString="SamSs") returned 5 [0274.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.772] lstrlenW (lpString="Schedule") returned 8 [0274.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.772] lstrlenW (lpString="SENS") returned 4 [0274.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.772] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.772] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.772] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.772] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.772] lstrlenW (lpString="Spooler") returned 7 [0274.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.772] lstrlenW (lpString="sppsvc") returned 6 [0274.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0274.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0274.772] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0274.772] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0274.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0274.772] lstrlenW (lpString="SysMain") returned 7 [0274.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0274.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0274.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0274.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0274.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0274.773] lstrlenW (lpString="Themes") returned 6 [0274.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0274.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0274.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0274.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0274.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0274.773] lstrlenW (lpString="TrkWks") returned 6 [0274.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0274.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0274.773] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0274.773] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0274.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0274.773] lstrlenW (lpString="UxSms") returned 5 [0274.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0274.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0274.773] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0274.773] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0274.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0274.773] lstrlenW (lpString="VSS") returned 3 [0274.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0274.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0274.773] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0274.773] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0274.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0274.773] lstrlenW (lpString="WdiServiceHost") returned 14 [0274.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0274.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0274.773] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0274.773] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0274.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0274.773] lstrlenW (lpString="WdiSystemHost") returned 13 [0274.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0274.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0274.773] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0274.774] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0274.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0274.774] lstrlenW (lpString="WinDefend") returned 9 [0274.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0274.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0274.774] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0274.774] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0274.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0274.774] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0274.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0274.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0274.774] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0274.774] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0274.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0274.774] lstrlenW (lpString="Winmgmt") returned 7 [0274.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0274.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0274.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0274.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0274.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0274.774] lstrlenW (lpString="wscsvc") returned 6 [0274.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0274.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0274.774] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0274.774] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0274.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0274.774] lstrlenW (lpString="wuauserv") returned 8 [0274.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0274.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0274.774] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0274.774] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0274.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0274.774] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0274.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0274.777] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.778] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.778] lstrlenW (lpString="System") returned 6 [0274.778] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0274.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0274.778] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0274.778] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0274.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0274.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0274.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0274.779] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.779] lstrlenW (lpString="smss.exe") returned 8 [0274.779] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0274.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0274.779] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.780] lstrlenW (lpString="csrss.exe") returned 9 [0274.780] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.781] lstrlenW (lpString="wininit.exe") returned 11 [0274.781] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.781] lstrlenW (lpString="csrss.exe") returned 9 [0274.781] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.782] lstrlenW (lpString="winlogon.exe") returned 12 [0274.783] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.783] lstrlenW (lpString="services.exe") returned 12 [0274.783] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.784] lstrlenW (lpString="lsass.exe") returned 9 [0274.784] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.785] lstrlenW (lpString="lsm.exe") returned 7 [0274.785] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.785] lstrlenW (lpString="svchost.exe") returned 11 [0274.785] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.786] lstrlenW (lpString="svchost.exe") returned 11 [0274.786] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.787] lstrlenW (lpString="svchost.exe") returned 11 [0274.787] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.788] lstrlenW (lpString="svchost.exe") returned 11 [0274.788] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.789] lstrlenW (lpString="svchost.exe") returned 11 [0274.789] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.790] lstrlenW (lpString="audiodg.exe") returned 11 [0274.790] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.791] lstrlenW (lpString="svchost.exe") returned 11 [0274.791] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.792] lstrlenW (lpString="svchost.exe") returned 11 [0274.792] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.792] lstrlenW (lpString="dwm.exe") returned 7 [0274.793] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.793] lstrlenW (lpString="explorer.exe") returned 12 [0274.793] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.794] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.794] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.795] lstrlenW (lpString="taskhost.exe") returned 12 [0274.795] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.796] lstrlenW (lpString="svchost.exe") returned 11 [0274.796] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0274.796] lstrlenW (lpString="taskeng.exe") returned 11 [0274.796] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.797] lstrlenW (lpString="svchost.exe") returned 11 [0274.797] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.798] lstrlenW (lpString="taskhost.exe") returned 12 [0274.798] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0274.799] lstrlenW (lpString="sppsvc.exe") returned 10 [0274.799] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.800] lstrlenW (lpString="svchost.exe") returned 11 [0274.800] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0274.800] lstrlenW (lpString="push nutrition.exe") returned 18 [0274.801] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0274.801] lstrlenW (lpString="procedures.exe") returned 14 [0274.801] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0274.802] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0274.802] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0274.803] lstrlenW (lpString="scanner-discover.exe") returned 20 [0274.803] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0274.803] lstrlenW (lpString="regression healthcare.exe") returned 25 [0274.803] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0274.804] lstrlenW (lpString="apr_zinc.exe") returned 12 [0274.804] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0274.805] lstrlenW (lpString="computer.exe") returned 12 [0274.805] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0274.805] lstrlenW (lpString="importanceweekend.exe") returned 21 [0274.805] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0274.806] lstrlenW (lpString="warm_absolute.exe") returned 17 [0274.806] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0274.807] lstrlenW (lpString="funding_editing.exe") returned 19 [0274.807] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0274.807] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0274.807] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0274.808] lstrlenW (lpString="friend.exe") returned 10 [0274.808] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0274.809] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0274.809] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0274.809] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0274.809] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0274.810] lstrlenW (lpString="individually_antiques.exe") returned 25 [0274.810] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0274.811] lstrlenW (lpString="embedded.exe") returned 12 [0274.811] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0274.811] lstrlenW (lpString="usually.exe") returned 11 [0274.811] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0274.812] lstrlenW (lpString="bills.exe") returned 9 [0274.812] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0274.813] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0274.813] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0274.814] lstrlenW (lpString="terminal.exe") returned 12 [0274.814] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0274.815] lstrlenW (lpString="ol_refers.exe") returned 13 [0274.815] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0274.815] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0274.816] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0274.816] lstrlenW (lpString="riding analyst.exe") returned 18 [0274.816] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0274.817] lstrlenW (lpString="robots.exe") returned 10 [0274.817] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.818] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0274.818] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0274.818] lstrlenW (lpString="expIorer32.exe") returned 14 [0274.818] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0274.819] lstrlenW (lpString="cmd.exe") returned 7 [0274.819] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0274.820] lstrlenW (lpString="conhost.exe") returned 11 [0274.820] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0274.820] lstrlenW (lpString="vssadmin.exe") returned 12 [0274.820] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0274.821] lstrlenW (lpString="VSSVC.exe") returned 9 [0274.821] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0274.822] CloseHandle (hObject=0x1b0) returned 1 [0274.822] Sleep (dwMilliseconds=0x1f4) [0275.340] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0275.340] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0275.341] GetLastError () returned 0xea [0275.341] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0275.341] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0275.341] CloseServiceHandle (hSCObject=0x360140) returned 1 [0275.342] lstrlenW (lpString="Appinfo") returned 7 [0275.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0275.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0275.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0275.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0275.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0275.342] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.342] lstrlenW (lpString="AudioSrv") returned 8 [0275.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0275.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0275.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0275.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0275.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0275.342] lstrlenW (lpString="BFE") returned 3 [0275.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.342] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.342] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.342] lstrlenW (lpString="CryptSvc") returned 8 [0275.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.343] lstrlenW (lpString="CscService") returned 10 [0275.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0275.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0275.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0275.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0275.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0275.343] lstrlenW (lpString="DcomLaunch") returned 10 [0275.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.343] lstrlenW (lpString="Dhcp") returned 4 [0275.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.344] lstrlenW (lpString="Dnscache") returned 8 [0275.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.344] lstrlenW (lpString="DPS") returned 3 [0275.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.344] lstrlenW (lpString="eventlog") returned 8 [0275.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0275.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0275.344] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0275.344] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0275.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0275.344] lstrlenW (lpString="EventSystem") returned 11 [0275.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.344] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.345] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.345] lstrlenW (lpString="FontCache") returned 9 [0275.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0275.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0275.345] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0275.345] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0275.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0275.345] lstrlenW (lpString="gpsvc") returned 5 [0275.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.345] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.345] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.345] lstrlenW (lpString="iphlpsvc") returned 8 [0275.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.345] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.345] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.345] lstrlenW (lpString="LanmanServer") returned 12 [0275.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.346] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.346] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.346] lstrlenW (lpString="lmhosts") returned 7 [0275.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.346] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.346] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.346] lstrlenW (lpString="MMCSS") returned 5 [0275.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0275.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0275.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0275.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0275.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0275.346] lstrlenW (lpString="MpsSvc") returned 6 [0275.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0275.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0275.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0275.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0275.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0275.346] lstrlenW (lpString="Netman") returned 6 [0275.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0275.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0275.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0275.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0275.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0275.347] lstrlenW (lpString="netprofm") returned 8 [0275.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0275.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0275.347] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0275.347] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0275.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0275.347] lstrlenW (lpString="NlaSvc") returned 6 [0275.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0275.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0275.347] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0275.347] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0275.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0275.347] lstrlenW (lpString="nsi") returned 3 [0275.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0275.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0275.347] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0275.347] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0275.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0275.347] lstrlenW (lpString="PcaSvc") returned 6 [0275.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0275.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0275.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0275.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0275.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0275.348] lstrlenW (lpString="PlugPlay") returned 8 [0275.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0275.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0275.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0275.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0275.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0275.349] lstrlenW (lpString="Power") returned 5 [0275.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0275.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0275.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0275.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0275.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0275.349] lstrlenW (lpString="ProfSvc") returned 7 [0275.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0275.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0275.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0275.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0275.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0275.349] lstrlenW (lpString="RpcEptMapper") returned 12 [0275.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.349] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0275.349] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0275.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0275.349] lstrlenW (lpString="RpcSs") returned 5 [0275.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0275.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0275.349] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0275.349] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0275.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0275.349] lstrlenW (lpString="SamSs") returned 5 [0275.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0275.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0275.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0275.350] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0275.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0275.350] lstrlenW (lpString="Schedule") returned 8 [0275.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0275.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0275.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0275.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0275.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0275.350] lstrlenW (lpString="SENS") returned 4 [0275.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0275.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0275.350] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0275.350] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0275.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0275.350] lstrlenW (lpString="ShellHWDetection") returned 16 [0275.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.350] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0275.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0275.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0275.350] lstrlenW (lpString="Spooler") returned 7 [0275.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0275.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0275.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0275.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0275.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0275.351] lstrlenW (lpString="sppsvc") returned 6 [0275.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0275.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0275.351] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0275.351] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0275.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0275.351] lstrlenW (lpString="SysMain") returned 7 [0275.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0275.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0275.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0275.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0275.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0275.351] lstrlenW (lpString="Themes") returned 6 [0275.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0275.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0275.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0275.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0275.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0275.351] lstrlenW (lpString="TrkWks") returned 6 [0275.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0275.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0275.351] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0275.351] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0275.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0275.351] lstrlenW (lpString="UxSms") returned 5 [0275.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0275.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0275.351] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0275.352] lstrlenW (lpString="VSS") returned 3 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0275.352] lstrlenW (lpString="WdiServiceHost") returned 14 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0275.352] lstrlenW (lpString="WdiSystemHost") returned 13 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0275.352] lstrlenW (lpString="WinDefend") returned 9 [0275.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0275.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0275.352] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0275.352] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0275.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0275.352] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0275.353] lstrlenW (lpString="Winmgmt") returned 7 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0275.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0275.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0275.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0275.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0275.353] lstrlenW (lpString="wscsvc") returned 6 [0275.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0275.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0275.366] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0275.366] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0275.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0275.366] lstrlenW (lpString="wuauserv") returned 8 [0275.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0275.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0275.367] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0275.367] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0275.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0275.367] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0275.367] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0275.369] Process32FirstW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.370] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.371] lstrlenW (lpString="System") returned 6 [0275.371] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0275.371] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0275.371] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0275.371] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0275.371] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0275.371] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0275.371] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0275.371] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.372] lstrlenW (lpString="smss.exe") returned 8 [0275.372] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0275.372] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0275.372] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.373] lstrlenW (lpString="csrss.exe") returned 9 [0275.373] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.374] lstrlenW (lpString="wininit.exe") returned 11 [0275.374] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.375] lstrlenW (lpString="csrss.exe") returned 9 [0275.375] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.376] lstrlenW (lpString="winlogon.exe") returned 12 [0275.376] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.377] lstrlenW (lpString="services.exe") returned 12 [0275.377] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.378] lstrlenW (lpString="lsass.exe") returned 9 [0275.378] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0275.379] lstrlenW (lpString="lsm.exe") returned 7 [0275.379] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.380] lstrlenW (lpString="svchost.exe") returned 11 [0275.380] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.381] lstrlenW (lpString="svchost.exe") returned 11 [0275.381] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.381] lstrlenW (lpString="svchost.exe") returned 11 [0275.382] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.382] lstrlenW (lpString="svchost.exe") returned 11 [0275.382] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.383] lstrlenW (lpString="svchost.exe") returned 11 [0275.383] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.384] lstrlenW (lpString="audiodg.exe") returned 11 [0275.384] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.385] lstrlenW (lpString="svchost.exe") returned 11 [0275.385] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.386] lstrlenW (lpString="svchost.exe") returned 11 [0275.386] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.388] lstrlenW (lpString="dwm.exe") returned 7 [0275.388] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.389] lstrlenW (lpString="explorer.exe") returned 12 [0275.389] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.390] lstrlenW (lpString="spoolsv.exe") returned 11 [0275.390] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.395] lstrlenW (lpString="taskhost.exe") returned 12 [0275.395] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.396] lstrlenW (lpString="svchost.exe") returned 11 [0275.396] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0275.397] lstrlenW (lpString="taskeng.exe") returned 11 [0275.397] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.398] lstrlenW (lpString="svchost.exe") returned 11 [0275.398] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.398] lstrlenW (lpString="taskhost.exe") returned 12 [0275.398] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0275.399] lstrlenW (lpString="sppsvc.exe") returned 10 [0275.399] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.400] lstrlenW (lpString="svchost.exe") returned 11 [0275.400] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0275.401] lstrlenW (lpString="push nutrition.exe") returned 18 [0275.401] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0275.402] lstrlenW (lpString="procedures.exe") returned 14 [0275.402] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0275.402] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0275.402] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0275.403] lstrlenW (lpString="scanner-discover.exe") returned 20 [0275.403] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0275.404] lstrlenW (lpString="regression healthcare.exe") returned 25 [0275.404] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0275.405] lstrlenW (lpString="apr_zinc.exe") returned 12 [0275.405] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0275.405] lstrlenW (lpString="computer.exe") returned 12 [0275.405] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0275.407] lstrlenW (lpString="importanceweekend.exe") returned 21 [0275.407] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0275.407] lstrlenW (lpString="warm_absolute.exe") returned 17 [0275.407] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0275.408] lstrlenW (lpString="funding_editing.exe") returned 19 [0275.408] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0275.409] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0275.409] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0275.410] lstrlenW (lpString="friend.exe") returned 10 [0275.410] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0275.411] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0275.411] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0275.411] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0275.412] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0275.412] lstrlenW (lpString="individually_antiques.exe") returned 25 [0275.412] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0275.413] lstrlenW (lpString="embedded.exe") returned 12 [0275.413] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0275.414] lstrlenW (lpString="usually.exe") returned 11 [0275.414] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0275.415] lstrlenW (lpString="bills.exe") returned 9 [0275.415] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0275.416] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0275.416] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0275.417] lstrlenW (lpString="terminal.exe") returned 12 [0275.417] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0275.417] lstrlenW (lpString="ol_refers.exe") returned 13 [0275.417] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0275.418] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0275.418] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0275.419] lstrlenW (lpString="riding analyst.exe") returned 18 [0275.419] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0275.419] lstrlenW (lpString="robots.exe") returned 10 [0275.419] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.420] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0275.420] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0275.421] lstrlenW (lpString="expIorer32.exe") returned 14 [0275.421] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0275.421] lstrlenW (lpString="cmd.exe") returned 7 [0275.421] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0275.422] lstrlenW (lpString="conhost.exe") returned 11 [0275.422] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0275.423] lstrlenW (lpString="vssadmin.exe") returned 12 [0275.423] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0275.423] lstrlenW (lpString="VSSVC.exe") returned 9 [0275.424] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0275.424] CloseHandle (hObject=0x180) returned 1 [0275.424] Sleep (dwMilliseconds=0x1f4) [0275.936] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0275.937] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0275.937] GetLastError () returned 0xea [0275.937] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0275.937] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0275.937] CloseServiceHandle (hSCObject=0x360140) returned 1 [0275.938] lstrlenW (lpString="Appinfo") returned 7 [0275.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0275.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0275.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0275.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0275.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0275.938] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.938] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.938] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.938] lstrlenW (lpString="AudioSrv") returned 8 [0275.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0275.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0275.938] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0275.938] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0275.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0275.938] lstrlenW (lpString="BFE") returned 3 [0275.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.938] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.938] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.938] lstrlenW (lpString="CryptSvc") returned 8 [0275.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.938] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.938] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.939] lstrlenW (lpString="CscService") returned 10 [0275.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0275.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0275.939] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0275.939] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0275.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0275.939] lstrlenW (lpString="DcomLaunch") returned 10 [0275.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.939] lstrlenW (lpString="Dhcp") returned 4 [0275.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.939] lstrlenW (lpString="Dnscache") returned 8 [0275.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.939] lstrlenW (lpString="DPS") returned 3 [0275.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.939] lstrlenW (lpString="eventlog") returned 8 [0275.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0275.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0275.939] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0275.939] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0275.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0275.940] lstrlenW (lpString="EventSystem") returned 11 [0275.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.940] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.940] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.940] lstrlenW (lpString="FontCache") returned 9 [0275.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0275.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0275.940] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0275.940] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0275.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0275.940] lstrlenW (lpString="gpsvc") returned 5 [0275.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.940] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.940] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.940] lstrlenW (lpString="iphlpsvc") returned 8 [0275.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.940] lstrlenW (lpString="LanmanServer") returned 12 [0275.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.940] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.941] lstrlenW (lpString="lmhosts") returned 7 [0275.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.941] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.941] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.941] lstrlenW (lpString="MMCSS") returned 5 [0275.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0275.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0275.941] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0275.941] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0275.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0275.941] lstrlenW (lpString="MpsSvc") returned 6 [0275.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0275.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0275.941] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0275.941] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0275.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0275.941] lstrlenW (lpString="Netman") returned 6 [0275.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0275.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0275.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0275.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0275.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0275.942] lstrlenW (lpString="netprofm") returned 8 [0275.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0275.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0275.942] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0275.942] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0275.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0275.942] lstrlenW (lpString="NlaSvc") returned 6 [0275.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0275.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0275.942] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0275.942] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0275.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0275.942] lstrlenW (lpString="nsi") returned 3 [0275.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0275.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0275.942] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0275.942] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0275.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0275.942] lstrlenW (lpString="PcaSvc") returned 6 [0275.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0275.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0275.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0275.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0275.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0275.942] lstrlenW (lpString="PlugPlay") returned 8 [0275.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0275.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0275.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0275.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0275.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0275.942] lstrlenW (lpString="Power") returned 5 [0275.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0275.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0275.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0275.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0275.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0275.943] lstrlenW (lpString="ProfSvc") returned 7 [0275.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0275.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0275.943] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0275.943] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0275.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0275.943] lstrlenW (lpString="RpcEptMapper") returned 12 [0275.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0275.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0275.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0275.943] lstrlenW (lpString="RpcSs") returned 5 [0275.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0275.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0275.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0275.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0275.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0275.943] lstrlenW (lpString="SamSs") returned 5 [0275.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0275.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0275.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0275.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0275.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0275.943] lstrlenW (lpString="Schedule") returned 8 [0275.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0275.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0275.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0275.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0275.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0275.943] lstrlenW (lpString="SENS") returned 4 [0275.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0275.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0275.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0275.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0275.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0275.944] lstrlenW (lpString="ShellHWDetection") returned 16 [0275.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.944] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0275.944] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0275.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0275.944] lstrlenW (lpString="Spooler") returned 7 [0275.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0275.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0275.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0275.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0275.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0275.944] lstrlenW (lpString="sppsvc") returned 6 [0275.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0275.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0275.944] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0275.944] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0275.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0275.944] lstrlenW (lpString="SysMain") returned 7 [0275.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0275.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0275.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0275.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0275.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0275.944] lstrlenW (lpString="Themes") returned 6 [0275.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0275.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0275.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0275.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0275.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0275.944] lstrlenW (lpString="TrkWks") returned 6 [0275.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0275.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0275.944] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0275.944] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0275.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0275.945] lstrlenW (lpString="UxSms") returned 5 [0275.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0275.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0275.945] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0275.945] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0275.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0275.945] lstrlenW (lpString="VSS") returned 3 [0275.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0275.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0275.945] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0275.945] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0275.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0275.945] lstrlenW (lpString="WdiServiceHost") returned 14 [0275.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0275.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0275.945] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0275.945] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0275.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0275.945] lstrlenW (lpString="WdiSystemHost") returned 13 [0275.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0275.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0275.945] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0275.945] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0275.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0275.945] lstrlenW (lpString="WinDefend") returned 9 [0275.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0275.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0275.945] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0275.945] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0275.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0275.945] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0275.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0275.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0275.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0275.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0275.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0275.946] lstrlenW (lpString="Winmgmt") returned 7 [0275.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0275.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0275.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0275.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0275.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0275.946] lstrlenW (lpString="wscsvc") returned 6 [0275.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0275.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0275.946] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0275.946] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0275.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0275.946] lstrlenW (lpString="wuauserv") returned 8 [0275.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0275.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0275.946] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0275.946] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0275.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0275.946] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0275.946] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0275.948] Process32FirstW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.949] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.950] lstrlenW (lpString="System") returned 6 [0275.950] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0275.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0275.950] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0275.950] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0275.950] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0275.950] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0275.950] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0275.950] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.951] lstrlenW (lpString="smss.exe") returned 8 [0275.951] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0275.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0275.951] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.952] lstrlenW (lpString="csrss.exe") returned 9 [0275.952] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.953] lstrlenW (lpString="wininit.exe") returned 11 [0275.953] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.954] lstrlenW (lpString="csrss.exe") returned 9 [0275.954] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.954] lstrlenW (lpString="winlogon.exe") returned 12 [0275.954] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.955] lstrlenW (lpString="services.exe") returned 12 [0275.955] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.956] lstrlenW (lpString="lsass.exe") returned 9 [0275.956] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0275.956] lstrlenW (lpString="lsm.exe") returned 7 [0275.956] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.957] lstrlenW (lpString="svchost.exe") returned 11 [0275.957] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.958] lstrlenW (lpString="svchost.exe") returned 11 [0275.958] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.958] lstrlenW (lpString="svchost.exe") returned 11 [0275.959] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.959] lstrlenW (lpString="svchost.exe") returned 11 [0275.959] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.960] lstrlenW (lpString="svchost.exe") returned 11 [0275.960] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.961] lstrlenW (lpString="audiodg.exe") returned 11 [0275.961] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.961] lstrlenW (lpString="svchost.exe") returned 11 [0275.961] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.962] lstrlenW (lpString="svchost.exe") returned 11 [0275.962] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.963] lstrlenW (lpString="dwm.exe") returned 7 [0275.963] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.964] lstrlenW (lpString="explorer.exe") returned 12 [0275.964] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.965] lstrlenW (lpString="spoolsv.exe") returned 11 [0275.965] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.965] lstrlenW (lpString="taskhost.exe") returned 12 [0275.965] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.966] lstrlenW (lpString="svchost.exe") returned 11 [0275.966] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0275.967] lstrlenW (lpString="taskeng.exe") returned 11 [0275.967] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.968] lstrlenW (lpString="svchost.exe") returned 11 [0275.968] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.968] lstrlenW (lpString="taskhost.exe") returned 12 [0275.968] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0275.969] lstrlenW (lpString="sppsvc.exe") returned 10 [0275.969] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.970] lstrlenW (lpString="svchost.exe") returned 11 [0275.970] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0275.971] lstrlenW (lpString="push nutrition.exe") returned 18 [0275.971] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0275.971] lstrlenW (lpString="procedures.exe") returned 14 [0275.971] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0275.972] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0275.972] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0275.973] lstrlenW (lpString="scanner-discover.exe") returned 20 [0275.973] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0275.973] lstrlenW (lpString="regression healthcare.exe") returned 25 [0275.973] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0275.974] lstrlenW (lpString="apr_zinc.exe") returned 12 [0275.974] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0275.975] lstrlenW (lpString="computer.exe") returned 12 [0275.975] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0275.975] lstrlenW (lpString="importanceweekend.exe") returned 21 [0275.975] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0275.976] lstrlenW (lpString="warm_absolute.exe") returned 17 [0275.976] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0275.977] lstrlenW (lpString="funding_editing.exe") returned 19 [0275.977] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0275.977] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0275.977] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0275.978] lstrlenW (lpString="friend.exe") returned 10 [0275.978] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0275.979] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0275.979] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0275.980] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0275.980] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0275.980] lstrlenW (lpString="individually_antiques.exe") returned 25 [0275.980] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0275.981] lstrlenW (lpString="embedded.exe") returned 12 [0275.981] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0275.982] lstrlenW (lpString="usually.exe") returned 11 [0275.982] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0275.982] lstrlenW (lpString="bills.exe") returned 9 [0275.982] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0275.983] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0275.983] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0275.984] lstrlenW (lpString="terminal.exe") returned 12 [0275.984] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0275.985] lstrlenW (lpString="ol_refers.exe") returned 13 [0275.985] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0275.986] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0275.986] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0275.986] lstrlenW (lpString="riding analyst.exe") returned 18 [0275.986] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0275.987] lstrlenW (lpString="robots.exe") returned 10 [0275.987] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0275.988] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0275.988] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0275.989] lstrlenW (lpString="expIorer32.exe") returned 14 [0275.989] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0275.989] lstrlenW (lpString="cmd.exe") returned 7 [0275.989] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0275.990] lstrlenW (lpString="conhost.exe") returned 11 [0275.990] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0275.991] lstrlenW (lpString="vssadmin.exe") returned 12 [0275.991] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0275.991] lstrlenW (lpString="VSSVC.exe") returned 9 [0275.992] Process32NextW (in: hSnapshot=0x18c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0275.992] CloseHandle (hObject=0x18c) returned 1 [0275.992] Sleep (dwMilliseconds=0x1f4) [0276.498] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0276.498] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0276.499] GetLastError () returned 0xea [0276.499] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0276.499] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0276.500] CloseServiceHandle (hSCObject=0x360140) returned 1 [0276.500] lstrlenW (lpString="Appinfo") returned 7 [0276.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0276.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0276.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0276.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0276.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0276.500] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0276.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0276.500] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0276.500] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0276.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0276.500] lstrlenW (lpString="AudioSrv") returned 8 [0276.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0276.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0276.500] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0276.500] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0276.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0276.501] lstrlenW (lpString="BFE") returned 3 [0276.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0276.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0276.501] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0276.501] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0276.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0276.501] lstrlenW (lpString="CryptSvc") returned 8 [0276.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0276.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0276.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0276.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0276.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0276.501] lstrlenW (lpString="CscService") returned 10 [0276.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0276.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0276.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0276.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0276.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0276.501] lstrlenW (lpString="DcomLaunch") returned 10 [0276.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0276.501] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0276.501] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0276.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0276.501] lstrlenW (lpString="Dhcp") returned 4 [0276.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0276.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0276.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0276.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0276.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0276.502] lstrlenW (lpString="Dnscache") returned 8 [0276.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0276.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0276.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0276.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0276.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0276.502] lstrlenW (lpString="DPS") returned 3 [0276.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0276.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0276.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0276.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0276.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0276.502] lstrlenW (lpString="eventlog") returned 8 [0276.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0276.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0276.502] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0276.502] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0276.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0276.502] lstrlenW (lpString="EventSystem") returned 11 [0276.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0276.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0276.502] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0276.502] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0276.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0276.502] lstrlenW (lpString="FontCache") returned 9 [0276.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0276.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0276.503] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0276.503] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0276.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0276.503] lstrlenW (lpString="gpsvc") returned 5 [0276.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0276.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0276.503] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0276.503] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0276.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0276.503] lstrlenW (lpString="iphlpsvc") returned 8 [0276.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0276.503] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0276.503] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0276.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0276.503] lstrlenW (lpString="LanmanServer") returned 12 [0276.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0276.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0276.503] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0276.503] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0276.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0276.503] lstrlenW (lpString="LanmanWorkstation") returned 17 [0276.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0276.503] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0276.503] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0276.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0276.504] lstrlenW (lpString="lmhosts") returned 7 [0276.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0276.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0276.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0276.504] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0276.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0276.504] lstrlenW (lpString="MMCSS") returned 5 [0276.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0276.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0276.504] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0276.504] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0276.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0276.504] lstrlenW (lpString="MpsSvc") returned 6 [0276.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0276.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0276.504] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0276.504] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0276.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0276.504] lstrlenW (lpString="Netman") returned 6 [0276.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0276.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0276.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0276.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0276.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0276.505] lstrlenW (lpString="netprofm") returned 8 [0276.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0276.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0276.505] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0276.505] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0276.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0276.505] lstrlenW (lpString="NlaSvc") returned 6 [0276.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0276.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0276.505] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0276.505] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0276.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0276.505] lstrlenW (lpString="nsi") returned 3 [0276.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0276.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0276.505] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0276.505] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0276.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0276.505] lstrlenW (lpString="PcaSvc") returned 6 [0276.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0276.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0276.505] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0276.506] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0276.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0276.506] lstrlenW (lpString="PlugPlay") returned 8 [0276.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0276.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0276.506] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0276.506] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0276.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0276.506] lstrlenW (lpString="Power") returned 5 [0276.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0276.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0276.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0276.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0276.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0276.506] lstrlenW (lpString="ProfSvc") returned 7 [0276.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0276.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0276.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0276.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0276.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0276.506] lstrlenW (lpString="RpcEptMapper") returned 12 [0276.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0276.507] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0276.507] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0276.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0276.507] lstrlenW (lpString="RpcSs") returned 5 [0276.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0276.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0276.507] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0276.507] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0276.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0276.507] lstrlenW (lpString="SamSs") returned 5 [0276.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0276.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0276.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0276.507] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0276.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0276.507] lstrlenW (lpString="Schedule") returned 8 [0276.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0276.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0276.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0276.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0276.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0276.507] lstrlenW (lpString="SENS") returned 4 [0276.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0276.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0276.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0276.507] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0276.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0276.508] lstrlenW (lpString="ShellHWDetection") returned 16 [0276.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0276.508] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0276.508] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0276.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0276.508] lstrlenW (lpString="Spooler") returned 7 [0276.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0276.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0276.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0276.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0276.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0276.508] lstrlenW (lpString="sppsvc") returned 6 [0276.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0276.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0276.508] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0276.508] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0276.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0276.508] lstrlenW (lpString="SysMain") returned 7 [0276.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0276.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0276.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0276.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0276.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0276.508] lstrlenW (lpString="Themes") returned 6 [0276.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0276.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0276.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0276.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0276.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0276.509] lstrlenW (lpString="TrkWks") returned 6 [0276.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0276.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0276.509] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0276.509] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0276.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0276.509] lstrlenW (lpString="UxSms") returned 5 [0276.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0276.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0276.509] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0276.509] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0276.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0276.509] lstrlenW (lpString="VSS") returned 3 [0276.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0276.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0276.509] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0276.509] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0276.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0276.509] lstrlenW (lpString="WdiServiceHost") returned 14 [0276.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0276.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0276.509] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0276.509] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0276.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0276.510] lstrlenW (lpString="WdiSystemHost") returned 13 [0276.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0276.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0276.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0276.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0276.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0276.510] lstrlenW (lpString="WinDefend") returned 9 [0276.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0276.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0276.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0276.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0276.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0276.510] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0276.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0276.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0276.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0276.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0276.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0276.510] lstrlenW (lpString="Winmgmt") returned 7 [0276.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0276.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0276.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0276.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0276.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0276.510] lstrlenW (lpString="wscsvc") returned 6 [0276.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0276.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0276.511] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0276.511] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0276.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0276.511] lstrlenW (lpString="wuauserv") returned 8 [0276.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0276.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0276.511] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0276.511] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0276.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0276.511] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0276.511] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0276.514] Process32FirstW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.514] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.515] lstrlenW (lpString="System") returned 6 [0276.515] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0276.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0276.515] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0276.515] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0276.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0276.515] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0276.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0276.516] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.516] lstrlenW (lpString="smss.exe") returned 8 [0276.516] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0276.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0276.517] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.517] lstrlenW (lpString="csrss.exe") returned 9 [0276.518] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.518] lstrlenW (lpString="wininit.exe") returned 11 [0276.518] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.519] lstrlenW (lpString="csrss.exe") returned 9 [0276.519] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.520] lstrlenW (lpString="winlogon.exe") returned 12 [0276.520] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.521] lstrlenW (lpString="services.exe") returned 12 [0276.521] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.522] lstrlenW (lpString="lsass.exe") returned 9 [0276.522] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0276.523] lstrlenW (lpString="lsm.exe") returned 7 [0276.523] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.524] lstrlenW (lpString="svchost.exe") returned 11 [0276.524] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.525] lstrlenW (lpString="svchost.exe") returned 11 [0276.525] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.526] lstrlenW (lpString="svchost.exe") returned 11 [0276.526] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.527] lstrlenW (lpString="svchost.exe") returned 11 [0276.527] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.527] lstrlenW (lpString="svchost.exe") returned 11 [0276.528] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.528] lstrlenW (lpString="audiodg.exe") returned 11 [0276.528] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.530] lstrlenW (lpString="svchost.exe") returned 11 [0276.530] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.530] lstrlenW (lpString="svchost.exe") returned 11 [0276.531] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.531] lstrlenW (lpString="dwm.exe") returned 7 [0276.531] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.532] lstrlenW (lpString="explorer.exe") returned 12 [0276.532] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.533] lstrlenW (lpString="spoolsv.exe") returned 11 [0276.533] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0276.534] lstrlenW (lpString="taskhost.exe") returned 12 [0276.534] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.535] lstrlenW (lpString="svchost.exe") returned 11 [0276.535] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0276.536] lstrlenW (lpString="taskeng.exe") returned 11 [0276.536] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.537] lstrlenW (lpString="svchost.exe") returned 11 [0276.537] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0276.538] lstrlenW (lpString="taskhost.exe") returned 12 [0276.538] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0276.539] lstrlenW (lpString="sppsvc.exe") returned 10 [0276.539] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.540] lstrlenW (lpString="svchost.exe") returned 11 [0276.540] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0276.541] lstrlenW (lpString="push nutrition.exe") returned 18 [0276.541] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0276.542] lstrlenW (lpString="procedures.exe") returned 14 [0276.542] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0276.543] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0276.543] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0276.544] lstrlenW (lpString="scanner-discover.exe") returned 20 [0276.544] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0276.545] lstrlenW (lpString="regression healthcare.exe") returned 25 [0276.545] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0276.546] lstrlenW (lpString="apr_zinc.exe") returned 12 [0276.546] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0276.547] lstrlenW (lpString="computer.exe") returned 12 [0276.547] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0276.548] lstrlenW (lpString="importanceweekend.exe") returned 21 [0276.548] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0276.549] lstrlenW (lpString="warm_absolute.exe") returned 17 [0276.549] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0276.550] lstrlenW (lpString="funding_editing.exe") returned 19 [0276.550] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0276.551] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0276.551] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0276.552] lstrlenW (lpString="friend.exe") returned 10 [0276.552] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0276.553] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0276.553] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0276.554] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0276.554] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0276.555] lstrlenW (lpString="individually_antiques.exe") returned 25 [0276.555] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0276.557] lstrlenW (lpString="embedded.exe") returned 12 [0276.557] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0276.592] lstrlenW (lpString="usually.exe") returned 11 [0276.592] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0276.593] lstrlenW (lpString="bills.exe") returned 9 [0276.593] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0276.594] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0276.594] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0276.595] lstrlenW (lpString="terminal.exe") returned 12 [0276.595] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0276.596] lstrlenW (lpString="ol_refers.exe") returned 13 [0276.596] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0276.597] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0276.597] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0276.597] lstrlenW (lpString="riding analyst.exe") returned 18 [0276.598] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0276.598] lstrlenW (lpString="robots.exe") returned 10 [0276.598] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0276.599] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0276.599] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0276.600] lstrlenW (lpString="expIorer32.exe") returned 14 [0276.600] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0276.601] lstrlenW (lpString="cmd.exe") returned 7 [0276.601] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0276.602] lstrlenW (lpString="conhost.exe") returned 11 [0276.602] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0276.603] lstrlenW (lpString="vssadmin.exe") returned 12 [0276.603] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0276.604] lstrlenW (lpString="VSSVC.exe") returned 9 [0276.604] Process32NextW (in: hSnapshot=0x20c, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0276.605] CloseHandle (hObject=0x20c) returned 1 [0276.605] Sleep (dwMilliseconds=0x1f4) [0277.184] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0277.185] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0277.185] GetLastError () returned 0xea [0277.185] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0277.185] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0277.186] CloseServiceHandle (hSCObject=0x360140) returned 1 [0277.186] lstrlenW (lpString="Appinfo") returned 7 [0277.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0277.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0277.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0277.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0277.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0277.187] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0277.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.187] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0277.187] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0277.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0277.187] lstrlenW (lpString="AudioSrv") returned 8 [0277.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0277.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0277.187] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0277.187] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0277.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0277.187] lstrlenW (lpString="BFE") returned 3 [0277.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0277.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0277.187] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0277.187] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0277.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0277.187] lstrlenW (lpString="CryptSvc") returned 8 [0277.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0277.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0277.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0277.187] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0277.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0277.187] lstrlenW (lpString="CscService") returned 10 [0277.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0277.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0277.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0277.188] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0277.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0277.188] lstrlenW (lpString="DcomLaunch") returned 10 [0277.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0277.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0277.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0277.188] lstrlenW (lpString="Dhcp") returned 4 [0277.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0277.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0277.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0277.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0277.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0277.188] lstrlenW (lpString="Dnscache") returned 8 [0277.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0277.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0277.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0277.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0277.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0277.188] lstrlenW (lpString="DPS") returned 3 [0277.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0277.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0277.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0277.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0277.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0277.188] lstrlenW (lpString="eventlog") returned 8 [0277.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0277.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0277.189] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0277.189] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0277.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0277.189] lstrlenW (lpString="EventSystem") returned 11 [0277.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0277.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0277.189] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0277.189] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0277.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0277.189] lstrlenW (lpString="FontCache") returned 9 [0277.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0277.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0277.189] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0277.189] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0277.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0277.189] lstrlenW (lpString="gpsvc") returned 5 [0277.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0277.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0277.189] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0277.189] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0277.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0277.189] lstrlenW (lpString="iphlpsvc") returned 8 [0277.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.189] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0277.189] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0277.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0277.189] lstrlenW (lpString="LanmanServer") returned 12 [0277.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0277.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0277.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0277.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0277.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0277.190] lstrlenW (lpString="LanmanWorkstation") returned 17 [0277.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0277.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0277.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0277.190] lstrlenW (lpString="lmhosts") returned 7 [0277.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0277.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0277.190] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0277.190] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0277.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0277.190] lstrlenW (lpString="MMCSS") returned 5 [0277.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0277.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0277.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0277.190] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0277.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0277.190] lstrlenW (lpString="MpsSvc") returned 6 [0277.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0277.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0277.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0277.190] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0277.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0277.191] lstrlenW (lpString="Netman") returned 6 [0277.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0277.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0277.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0277.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0277.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0277.191] lstrlenW (lpString="netprofm") returned 8 [0277.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0277.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0277.191] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0277.191] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0277.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0277.191] lstrlenW (lpString="NlaSvc") returned 6 [0277.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0277.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0277.191] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0277.191] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0277.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0277.191] lstrlenW (lpString="nsi") returned 3 [0277.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0277.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0277.191] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0277.191] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0277.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0277.191] lstrlenW (lpString="PcaSvc") returned 6 [0277.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0277.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0277.191] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0277.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0277.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0277.192] lstrlenW (lpString="PlugPlay") returned 8 [0277.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0277.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0277.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0277.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0277.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0277.192] lstrlenW (lpString="Power") returned 5 [0277.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0277.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0277.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0277.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0277.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0277.192] lstrlenW (lpString="ProfSvc") returned 7 [0277.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0277.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0277.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0277.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0277.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0277.192] lstrlenW (lpString="RpcEptMapper") returned 12 [0277.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0277.192] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0277.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0277.192] lstrlenW (lpString="RpcSs") returned 5 [0277.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0277.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0277.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0277.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0277.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0277.193] lstrlenW (lpString="SamSs") returned 5 [0277.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0277.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0277.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0277.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0277.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0277.193] lstrlenW (lpString="Schedule") returned 8 [0277.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0277.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0277.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0277.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0277.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0277.193] lstrlenW (lpString="SENS") returned 4 [0277.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0277.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0277.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0277.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0277.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0277.193] lstrlenW (lpString="ShellHWDetection") returned 16 [0277.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.193] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0277.193] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0277.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0277.193] lstrlenW (lpString="Spooler") returned 7 [0277.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0277.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0277.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0277.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0277.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0277.194] lstrlenW (lpString="sppsvc") returned 6 [0277.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0277.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0277.194] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0277.194] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0277.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0277.194] lstrlenW (lpString="SysMain") returned 7 [0277.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0277.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0277.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0277.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.194] lstrlenW (lpString="Themes") returned 6 [0277.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0277.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0277.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0277.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0277.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0277.194] lstrlenW (lpString="TrkWks") returned 6 [0277.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0277.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0277.194] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0277.194] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0277.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0277.194] lstrlenW (lpString="UxSms") returned 5 [0277.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0277.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0277.194] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0277.195] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0277.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0277.195] lstrlenW (lpString="VSS") returned 3 [0277.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0277.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0277.195] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0277.195] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0277.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0277.195] lstrlenW (lpString="WdiServiceHost") returned 14 [0277.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0277.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0277.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0277.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0277.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0277.195] lstrlenW (lpString="WdiSystemHost") returned 13 [0277.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0277.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0277.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0277.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0277.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0277.195] lstrlenW (lpString="WinDefend") returned 9 [0277.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0277.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0277.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0277.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0277.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0277.196] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0277.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0277.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0277.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0277.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0277.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0277.196] lstrlenW (lpString="Winmgmt") returned 7 [0277.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0277.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0277.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0277.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0277.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0277.197] lstrlenW (lpString="wscsvc") returned 6 [0277.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0277.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0277.197] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0277.197] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0277.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0277.197] lstrlenW (lpString="wuauserv") returned 8 [0277.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0277.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0277.197] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0277.197] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0277.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0277.197] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0277.197] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0277.200] Process32FirstW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.201] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.204] lstrlenW (lpString="System") returned 6 [0277.204] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0277.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0277.204] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0277.204] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0277.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0277.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0277.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0277.204] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.205] lstrlenW (lpString="smss.exe") returned 8 [0277.205] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0277.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0277.205] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.206] lstrlenW (lpString="csrss.exe") returned 9 [0277.206] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.206] lstrlenW (lpString="wininit.exe") returned 11 [0277.207] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.207] lstrlenW (lpString="csrss.exe") returned 9 [0277.207] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.208] lstrlenW (lpString="winlogon.exe") returned 12 [0277.208] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.209] lstrlenW (lpString="services.exe") returned 12 [0277.209] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.210] lstrlenW (lpString="lsass.exe") returned 9 [0277.210] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.211] lstrlenW (lpString="lsm.exe") returned 7 [0277.211] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.211] lstrlenW (lpString="svchost.exe") returned 11 [0277.211] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.212] lstrlenW (lpString="svchost.exe") returned 11 [0277.212] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.217] lstrlenW (lpString="svchost.exe") returned 11 [0277.217] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.217] lstrlenW (lpString="svchost.exe") returned 11 [0277.217] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.218] lstrlenW (lpString="svchost.exe") returned 11 [0277.218] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.219] lstrlenW (lpString="audiodg.exe") returned 11 [0277.219] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.219] lstrlenW (lpString="svchost.exe") returned 11 [0277.219] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.220] lstrlenW (lpString="svchost.exe") returned 11 [0277.220] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.221] lstrlenW (lpString="dwm.exe") returned 7 [0277.221] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.222] lstrlenW (lpString="explorer.exe") returned 12 [0277.222] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.222] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.222] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.223] lstrlenW (lpString="taskhost.exe") returned 12 [0277.223] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.224] lstrlenW (lpString="svchost.exe") returned 11 [0277.224] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0277.225] lstrlenW (lpString="taskeng.exe") returned 11 [0277.225] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.226] lstrlenW (lpString="svchost.exe") returned 11 [0277.226] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.226] lstrlenW (lpString="taskhost.exe") returned 12 [0277.226] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0277.227] lstrlenW (lpString="sppsvc.exe") returned 10 [0277.227] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.228] lstrlenW (lpString="svchost.exe") returned 11 [0277.228] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0277.229] lstrlenW (lpString="push nutrition.exe") returned 18 [0277.229] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0277.230] lstrlenW (lpString="procedures.exe") returned 14 [0277.230] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0277.231] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0277.231] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0277.232] lstrlenW (lpString="scanner-discover.exe") returned 20 [0277.232] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0277.233] lstrlenW (lpString="regression healthcare.exe") returned 25 [0277.233] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0277.234] lstrlenW (lpString="apr_zinc.exe") returned 12 [0277.234] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0277.235] lstrlenW (lpString="computer.exe") returned 12 [0277.235] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0277.236] lstrlenW (lpString="importanceweekend.exe") returned 21 [0277.236] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0277.237] lstrlenW (lpString="warm_absolute.exe") returned 17 [0277.237] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0277.238] lstrlenW (lpString="funding_editing.exe") returned 19 [0277.238] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0277.239] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0277.239] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0277.239] lstrlenW (lpString="friend.exe") returned 10 [0277.240] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0277.240] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0277.240] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0277.241] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0277.241] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0277.242] lstrlenW (lpString="individually_antiques.exe") returned 25 [0277.242] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0277.243] lstrlenW (lpString="embedded.exe") returned 12 [0277.243] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0277.244] lstrlenW (lpString="usually.exe") returned 11 [0277.244] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0277.245] lstrlenW (lpString="bills.exe") returned 9 [0277.245] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0277.246] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0277.246] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0277.247] lstrlenW (lpString="terminal.exe") returned 12 [0277.247] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0277.248] lstrlenW (lpString="ol_refers.exe") returned 13 [0277.248] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0277.248] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0277.249] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0277.249] lstrlenW (lpString="riding analyst.exe") returned 18 [0277.249] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0277.250] lstrlenW (lpString="robots.exe") returned 10 [0277.250] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.251] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0277.251] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0277.252] lstrlenW (lpString="expIorer32.exe") returned 14 [0277.252] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0277.253] lstrlenW (lpString="cmd.exe") returned 7 [0277.253] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0277.254] lstrlenW (lpString="conhost.exe") returned 11 [0277.254] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0277.255] lstrlenW (lpString="vssadmin.exe") returned 12 [0277.255] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0277.255] lstrlenW (lpString="VSSVC.exe") returned 9 [0277.256] Process32NextW (in: hSnapshot=0x200, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0277.256] CloseHandle (hObject=0x200) returned 1 [0277.256] Sleep (dwMilliseconds=0x1f4) [0277.774] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0277.775] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0277.775] GetLastError () returned 0xea [0277.775] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0277.775] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0277.776] CloseServiceHandle (hSCObject=0x360140) returned 1 [0277.776] lstrlenW (lpString="Appinfo") returned 7 [0277.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0277.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0277.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0277.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0277.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0277.776] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0277.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0277.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0277.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0277.776] lstrlenW (lpString="AudioSrv") returned 8 [0277.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0277.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0277.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0277.777] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0277.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0277.777] lstrlenW (lpString="BFE") returned 3 [0277.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0277.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0277.777] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0277.777] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0277.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0277.777] lstrlenW (lpString="CryptSvc") returned 8 [0277.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0277.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0277.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0277.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0277.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0277.777] lstrlenW (lpString="CscService") returned 10 [0277.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0277.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0277.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0277.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0277.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0277.777] lstrlenW (lpString="DcomLaunch") returned 10 [0277.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0277.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0277.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0277.778] lstrlenW (lpString="Dhcp") returned 4 [0277.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0277.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0277.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0277.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0277.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0277.778] lstrlenW (lpString="Dnscache") returned 8 [0277.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0277.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0277.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0277.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0277.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0277.778] lstrlenW (lpString="DPS") returned 3 [0277.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0277.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0277.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0277.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0277.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0277.778] lstrlenW (lpString="eventlog") returned 8 [0277.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0277.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0277.778] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0277.778] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0277.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0277.778] lstrlenW (lpString="EventSystem") returned 11 [0277.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0277.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0277.779] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0277.779] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0277.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0277.779] lstrlenW (lpString="FontCache") returned 9 [0277.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0277.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0277.779] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0277.779] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0277.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0277.779] lstrlenW (lpString="gpsvc") returned 5 [0277.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0277.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0277.779] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0277.779] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0277.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0277.779] lstrlenW (lpString="iphlpsvc") returned 8 [0277.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.779] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0277.779] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0277.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0277.779] lstrlenW (lpString="LanmanServer") returned 12 [0277.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0277.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0277.780] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0277.780] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0277.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0277.780] lstrlenW (lpString="LanmanWorkstation") returned 17 [0277.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.780] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0277.780] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0277.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0277.780] lstrlenW (lpString="lmhosts") returned 7 [0277.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0277.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0277.780] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0277.780] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0277.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0277.780] lstrlenW (lpString="MMCSS") returned 5 [0277.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0277.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0277.780] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0277.780] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0277.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0277.780] lstrlenW (lpString="MpsSvc") returned 6 [0277.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0277.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0277.781] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0277.781] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0277.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0277.781] lstrlenW (lpString="Netman") returned 6 [0277.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0277.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0277.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0277.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0277.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0277.781] lstrlenW (lpString="netprofm") returned 8 [0277.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0277.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0277.781] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0277.781] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0277.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0277.781] lstrlenW (lpString="NlaSvc") returned 6 [0277.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0277.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0277.781] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0277.781] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0277.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0277.781] lstrlenW (lpString="nsi") returned 3 [0277.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0277.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0277.781] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0277.781] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0277.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0277.782] lstrlenW (lpString="PcaSvc") returned 6 [0277.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0277.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0277.782] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0277.782] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0277.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0277.782] lstrlenW (lpString="PlugPlay") returned 8 [0277.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0277.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0277.782] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0277.782] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0277.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0277.782] lstrlenW (lpString="Power") returned 5 [0277.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0277.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0277.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0277.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0277.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0277.782] lstrlenW (lpString="ProfSvc") returned 7 [0277.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0277.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0277.782] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0277.782] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0277.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0277.783] lstrlenW (lpString="RpcEptMapper") returned 12 [0277.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.783] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0277.783] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0277.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0277.783] lstrlenW (lpString="RpcSs") returned 5 [0277.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0277.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0277.783] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0277.783] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0277.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0277.783] lstrlenW (lpString="SamSs") returned 5 [0277.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0277.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0277.783] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0277.783] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0277.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0277.783] lstrlenW (lpString="Schedule") returned 8 [0277.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0277.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0277.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0277.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0277.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0277.783] lstrlenW (lpString="SENS") returned 4 [0277.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0277.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0277.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0277.784] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0277.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0277.784] lstrlenW (lpString="ShellHWDetection") returned 16 [0277.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.784] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0277.784] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0277.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0277.784] lstrlenW (lpString="Spooler") returned 7 [0277.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0277.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0277.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0277.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0277.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0277.784] lstrlenW (lpString="sppsvc") returned 6 [0277.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0277.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0277.784] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0277.784] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0277.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0277.784] lstrlenW (lpString="SysMain") returned 7 [0277.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0277.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0277.784] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0277.785] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.785] lstrlenW (lpString="Themes") returned 6 [0277.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0277.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0277.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0277.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0277.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0277.785] lstrlenW (lpString="TrkWks") returned 6 [0277.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0277.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0277.785] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0277.785] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0277.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0277.785] lstrlenW (lpString="UxSms") returned 5 [0277.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0277.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0277.785] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0277.785] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0277.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0277.785] lstrlenW (lpString="VSS") returned 3 [0277.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0277.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0277.785] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0277.785] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0277.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0277.785] lstrlenW (lpString="WdiServiceHost") returned 14 [0277.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0277.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0277.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0277.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0277.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0277.786] lstrlenW (lpString="WdiSystemHost") returned 13 [0277.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0277.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0277.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0277.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0277.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0277.786] lstrlenW (lpString="WinDefend") returned 9 [0277.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0277.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0277.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0277.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0277.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0277.786] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0277.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0277.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0277.786] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0277.786] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0277.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0277.786] lstrlenW (lpString="Winmgmt") returned 7 [0277.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0277.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0277.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0277.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0277.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0277.787] lstrlenW (lpString="wscsvc") returned 6 [0277.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0277.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0277.787] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0277.787] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0277.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0277.787] lstrlenW (lpString="wuauserv") returned 8 [0277.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0277.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0277.787] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0277.787] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0277.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0277.787] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0277.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0277.790] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.791] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.792] lstrlenW (lpString="System") returned 6 [0277.792] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0277.792] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0277.792] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0277.792] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0277.792] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0277.792] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0277.792] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0277.792] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.793] lstrlenW (lpString="smss.exe") returned 8 [0277.793] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0277.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0277.793] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.794] lstrlenW (lpString="csrss.exe") returned 9 [0277.794] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.795] lstrlenW (lpString="wininit.exe") returned 11 [0277.795] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.817] lstrlenW (lpString="csrss.exe") returned 9 [0277.817] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.818] lstrlenW (lpString="winlogon.exe") returned 12 [0277.818] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.819] lstrlenW (lpString="services.exe") returned 12 [0277.819] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.820] lstrlenW (lpString="lsass.exe") returned 9 [0277.820] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.821] lstrlenW (lpString="lsm.exe") returned 7 [0277.821] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.822] lstrlenW (lpString="svchost.exe") returned 11 [0277.822] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.823] lstrlenW (lpString="svchost.exe") returned 11 [0277.842] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.843] lstrlenW (lpString="svchost.exe") returned 11 [0277.844] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.845] lstrlenW (lpString="svchost.exe") returned 11 [0277.845] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.845] lstrlenW (lpString="svchost.exe") returned 11 [0277.846] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.846] lstrlenW (lpString="audiodg.exe") returned 11 [0277.847] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.847] lstrlenW (lpString="svchost.exe") returned 11 [0277.847] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.848] lstrlenW (lpString="svchost.exe") returned 11 [0277.848] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.854] lstrlenW (lpString="dwm.exe") returned 7 [0277.854] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.856] lstrlenW (lpString="explorer.exe") returned 12 [0277.856] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.857] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.857] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.858] lstrlenW (lpString="taskhost.exe") returned 12 [0277.858] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.859] lstrlenW (lpString="svchost.exe") returned 11 [0277.859] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0277.860] lstrlenW (lpString="taskeng.exe") returned 11 [0277.860] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.860] lstrlenW (lpString="svchost.exe") returned 11 [0277.861] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.913] lstrlenW (lpString="taskhost.exe") returned 12 [0277.913] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0277.914] lstrlenW (lpString="sppsvc.exe") returned 10 [0277.914] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.915] lstrlenW (lpString="svchost.exe") returned 11 [0277.915] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0277.916] lstrlenW (lpString="push nutrition.exe") returned 18 [0277.916] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0277.917] lstrlenW (lpString="procedures.exe") returned 14 [0277.917] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0277.918] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0277.918] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0277.919] lstrlenW (lpString="scanner-discover.exe") returned 20 [0277.919] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0277.920] lstrlenW (lpString="regression healthcare.exe") returned 25 [0277.920] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0277.921] lstrlenW (lpString="apr_zinc.exe") returned 12 [0277.921] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0277.922] lstrlenW (lpString="computer.exe") returned 12 [0277.922] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0277.944] lstrlenW (lpString="importanceweekend.exe") returned 21 [0277.944] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0277.945] lstrlenW (lpString="warm_absolute.exe") returned 17 [0277.945] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0277.946] lstrlenW (lpString="funding_editing.exe") returned 19 [0277.946] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0277.947] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0277.947] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0277.948] lstrlenW (lpString="friend.exe") returned 10 [0277.948] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0277.949] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0277.949] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0277.950] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0277.950] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0277.951] lstrlenW (lpString="individually_antiques.exe") returned 25 [0277.951] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0277.952] lstrlenW (lpString="embedded.exe") returned 12 [0277.952] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0277.953] lstrlenW (lpString="usually.exe") returned 11 [0277.953] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0277.954] lstrlenW (lpString="bills.exe") returned 9 [0277.954] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0277.954] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0277.955] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0277.955] lstrlenW (lpString="terminal.exe") returned 12 [0277.955] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0277.956] lstrlenW (lpString="ol_refers.exe") returned 13 [0277.956] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0277.957] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0277.957] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0277.958] lstrlenW (lpString="riding analyst.exe") returned 18 [0277.958] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0277.959] lstrlenW (lpString="robots.exe") returned 10 [0277.959] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.014] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0278.014] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0278.015] lstrlenW (lpString="expIorer32.exe") returned 14 [0278.015] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0278.016] lstrlenW (lpString="cmd.exe") returned 7 [0278.016] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0278.017] lstrlenW (lpString="conhost.exe") returned 11 [0278.017] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0278.017] lstrlenW (lpString="vssadmin.exe") returned 12 [0278.017] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0278.018] lstrlenW (lpString="VSSVC.exe") returned 9 [0278.018] Process32NextW (in: hSnapshot=0x1f8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0278.019] CloseHandle (hObject=0x1f8) returned 1 [0278.019] Sleep (dwMilliseconds=0x1f4) [0278.823] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0278.823] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0278.823] GetLastError () returned 0xea [0278.823] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x40248e8 [0278.823] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x40248e8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x40248e8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0278.824] CloseServiceHandle (hSCObject=0x360140) returned 1 [0278.824] lstrlenW (lpString="Appinfo") returned 7 [0278.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0278.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0278.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0278.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0278.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0278.824] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.825] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.825] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.825] lstrlenW (lpString="AudioSrv") returned 8 [0278.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0278.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0278.825] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0278.825] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0278.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0278.825] lstrlenW (lpString="BFE") returned 3 [0278.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.825] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.825] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.825] lstrlenW (lpString="CryptSvc") returned 8 [0278.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.825] lstrlenW (lpString="CscService") returned 10 [0278.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0278.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0278.825] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0278.825] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0278.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0278.825] lstrlenW (lpString="DcomLaunch") returned 10 [0278.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.826] lstrlenW (lpString="Dhcp") returned 4 [0278.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.826] lstrlenW (lpString="Dnscache") returned 8 [0278.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.826] lstrlenW (lpString="DPS") returned 3 [0278.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.826] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.826] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.826] lstrlenW (lpString="eventlog") returned 8 [0278.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0278.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0278.826] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0278.826] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0278.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0278.827] lstrlenW (lpString="EventSystem") returned 11 [0278.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.827] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.827] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.827] lstrlenW (lpString="FontCache") returned 9 [0278.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0278.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0278.827] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0278.827] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0278.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0278.827] lstrlenW (lpString="gpsvc") returned 5 [0278.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.827] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.827] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.827] lstrlenW (lpString="iphlpsvc") returned 8 [0278.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.827] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.827] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.827] lstrlenW (lpString="LanmanServer") returned 12 [0278.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.827] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.828] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.828] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.828] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.828] lstrlenW (lpString="lmhosts") returned 7 [0278.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.828] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.828] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.828] lstrlenW (lpString="MMCSS") returned 5 [0278.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0278.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0278.828] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0278.828] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0278.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0278.828] lstrlenW (lpString="MpsSvc") returned 6 [0278.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.828] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.828] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.828] lstrlenW (lpString="Netman") returned 6 [0278.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0278.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0278.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0278.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0278.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0278.829] lstrlenW (lpString="netprofm") returned 8 [0278.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.829] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.829] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.829] lstrlenW (lpString="NlaSvc") returned 6 [0278.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.829] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.829] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.829] lstrlenW (lpString="nsi") returned 3 [0278.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.829] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.829] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.829] lstrlenW (lpString="PcaSvc") returned 6 [0278.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.829] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.829] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.829] lstrlenW (lpString="PlugPlay") returned 8 [0278.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.830] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.830] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.830] lstrlenW (lpString="Power") returned 5 [0278.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.830] lstrlenW (lpString="ProfSvc") returned 7 [0278.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.830] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.830] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.830] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.830] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.830] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.830] lstrlenW (lpString="RpcSs") returned 5 [0278.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.830] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.830] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.831] lstrlenW (lpString="SamSs") returned 5 [0278.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.831] lstrlenW (lpString="Schedule") returned 8 [0278.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.831] lstrlenW (lpString="SENS") returned 4 [0278.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.831] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.831] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.831] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.831] lstrlenW (lpString="Spooler") returned 7 [0278.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.832] lstrlenW (lpString="sppsvc") returned 6 [0278.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0278.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0278.832] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0278.832] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0278.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0278.832] lstrlenW (lpString="SysMain") returned 7 [0278.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.832] lstrlenW (lpString="Themes") returned 6 [0278.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0278.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0278.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0278.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0278.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0278.832] lstrlenW (lpString="TrkWks") returned 6 [0278.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0278.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0278.832] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0278.832] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0278.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0278.832] lstrlenW (lpString="UxSms") returned 5 [0278.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0278.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0278.833] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0278.833] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0278.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0278.833] lstrlenW (lpString="VSS") returned 3 [0278.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0278.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0278.833] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0278.833] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0278.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0278.833] lstrlenW (lpString="WdiServiceHost") returned 14 [0278.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0278.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0278.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0278.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0278.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0278.833] lstrlenW (lpString="WdiSystemHost") returned 13 [0278.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0278.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0278.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0278.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0278.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0278.833] lstrlenW (lpString="WinDefend") returned 9 [0278.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0278.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0278.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0278.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0278.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0278.833] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0278.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0278.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0278.834] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0278.834] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0278.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0278.834] lstrlenW (lpString="Winmgmt") returned 7 [0278.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0278.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0278.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0278.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0278.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0278.834] lstrlenW (lpString="wscsvc") returned 6 [0278.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0278.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0278.834] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0278.834] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0278.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0278.834] lstrlenW (lpString="wuauserv") returned 8 [0278.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0278.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0278.834] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0278.834] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0278.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0278.834] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x40248e8 | out: hHeap=0x2e0000) returned 1 [0278.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0278.837] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.838] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.839] lstrlenW (lpString="System") returned 6 [0278.839] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0278.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0278.839] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0278.839] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0278.839] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0278.839] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0278.839] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0278.839] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.840] lstrlenW (lpString="smss.exe") returned 8 [0278.840] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0278.840] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0278.840] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.841] lstrlenW (lpString="csrss.exe") returned 9 [0278.841] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.842] lstrlenW (lpString="wininit.exe") returned 11 [0278.842] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.843] lstrlenW (lpString="csrss.exe") returned 9 [0278.843] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.844] lstrlenW (lpString="winlogon.exe") returned 12 [0278.844] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.845] lstrlenW (lpString="services.exe") returned 12 [0278.845] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.846] lstrlenW (lpString="lsass.exe") returned 9 [0278.846] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0278.847] lstrlenW (lpString="lsm.exe") returned 7 [0278.847] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.848] lstrlenW (lpString="svchost.exe") returned 11 [0278.848] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.849] lstrlenW (lpString="svchost.exe") returned 11 [0278.849] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.850] lstrlenW (lpString="svchost.exe") returned 11 [0278.850] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.851] lstrlenW (lpString="svchost.exe") returned 11 [0278.851] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.852] lstrlenW (lpString="svchost.exe") returned 11 [0278.852] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.853] lstrlenW (lpString="audiodg.exe") returned 11 [0278.853] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.854] lstrlenW (lpString="svchost.exe") returned 11 [0278.854] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.855] lstrlenW (lpString="svchost.exe") returned 11 [0278.855] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.856] lstrlenW (lpString="dwm.exe") returned 7 [0278.856] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.857] lstrlenW (lpString="explorer.exe") returned 12 [0278.857] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.858] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.858] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0278.859] lstrlenW (lpString="taskhost.exe") returned 12 [0278.859] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.860] lstrlenW (lpString="svchost.exe") returned 11 [0278.860] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0278.861] lstrlenW (lpString="taskeng.exe") returned 11 [0278.861] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.862] lstrlenW (lpString="svchost.exe") returned 11 [0278.862] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0278.863] lstrlenW (lpString="taskhost.exe") returned 12 [0278.863] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0278.864] lstrlenW (lpString="sppsvc.exe") returned 10 [0278.864] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.865] lstrlenW (lpString="svchost.exe") returned 11 [0278.865] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0278.866] lstrlenW (lpString="push nutrition.exe") returned 18 [0278.866] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0278.867] lstrlenW (lpString="procedures.exe") returned 14 [0278.867] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0278.868] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0278.868] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0279.166] lstrlenW (lpString="scanner-discover.exe") returned 20 [0279.166] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0279.167] lstrlenW (lpString="regression healthcare.exe") returned 25 [0279.167] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0279.168] lstrlenW (lpString="apr_zinc.exe") returned 12 [0279.168] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0279.174] lstrlenW (lpString="computer.exe") returned 12 [0279.174] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0279.175] lstrlenW (lpString="importanceweekend.exe") returned 21 [0279.175] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0279.176] lstrlenW (lpString="warm_absolute.exe") returned 17 [0279.176] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0279.176] lstrlenW (lpString="funding_editing.exe") returned 19 [0279.177] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0279.177] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0279.177] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0279.178] lstrlenW (lpString="friend.exe") returned 10 [0279.178] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0279.205] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0279.205] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0279.206] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0279.206] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0279.206] lstrlenW (lpString="individually_antiques.exe") returned 25 [0279.207] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0279.207] lstrlenW (lpString="embedded.exe") returned 12 [0279.207] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0279.208] lstrlenW (lpString="usually.exe") returned 11 [0279.208] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0279.209] lstrlenW (lpString="bills.exe") returned 9 [0279.209] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0279.210] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0279.210] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0279.211] lstrlenW (lpString="terminal.exe") returned 12 [0279.211] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0279.212] lstrlenW (lpString="ol_refers.exe") returned 13 [0279.212] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0279.213] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0279.213] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0279.214] lstrlenW (lpString="riding analyst.exe") returned 18 [0279.214] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0279.216] lstrlenW (lpString="robots.exe") returned 10 [0279.216] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.219] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0279.219] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0279.220] lstrlenW (lpString="expIorer32.exe") returned 14 [0279.220] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0279.221] lstrlenW (lpString="cmd.exe") returned 7 [0279.221] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0279.222] lstrlenW (lpString="conhost.exe") returned 11 [0279.222] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0279.223] lstrlenW (lpString="vssadmin.exe") returned 12 [0279.223] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0279.224] lstrlenW (lpString="VSSVC.exe") returned 9 [0279.224] Process32NextW (in: hSnapshot=0x1e0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0279.224] CloseHandle (hObject=0x1e0) returned 1 [0279.225] Sleep (dwMilliseconds=0x1f4) [0280.282] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0280.282] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0280.284] GetLastError () returned 0xea [0280.284] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x13a6) returned 0x39776f8 [0280.284] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39776f8, cbBufSize=0x13a6, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39776f8, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0280.285] CloseServiceHandle (hSCObject=0x360140) returned 1 [0280.285] lstrlenW (lpString="Appinfo") returned 7 [0280.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0280.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0280.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0280.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0280.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0280.285] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0280.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.286] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0280.286] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0280.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0280.286] lstrlenW (lpString="AudioSrv") returned 8 [0280.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0280.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0280.286] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0280.286] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0280.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0280.286] lstrlenW (lpString="BFE") returned 3 [0280.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0280.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0280.286] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0280.286] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0280.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0280.286] lstrlenW (lpString="CryptSvc") returned 8 [0280.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0280.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0280.286] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0280.286] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0280.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0280.286] lstrlenW (lpString="CscService") returned 10 [0280.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0280.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0280.286] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0280.286] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0280.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0280.287] lstrlenW (lpString="DcomLaunch") returned 10 [0280.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0280.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0280.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0280.287] lstrlenW (lpString="Dhcp") returned 4 [0280.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0280.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0280.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0280.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0280.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0280.287] lstrlenW (lpString="Dnscache") returned 8 [0280.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0280.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0280.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0280.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0280.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0280.287] lstrlenW (lpString="DPS") returned 3 [0280.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0280.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0280.287] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0280.287] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0280.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0280.287] lstrlenW (lpString="eventlog") returned 8 [0280.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0280.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0280.287] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0280.287] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0280.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0280.288] lstrlenW (lpString="EventSystem") returned 11 [0280.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0280.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0280.288] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0280.288] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0280.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0280.288] lstrlenW (lpString="FontCache") returned 9 [0280.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0280.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0280.288] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0280.288] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0280.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0280.288] lstrlenW (lpString="gpsvc") returned 5 [0280.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0280.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0280.288] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0280.288] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0280.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0280.289] lstrlenW (lpString="iphlpsvc") returned 8 [0280.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.289] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0280.289] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0280.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0280.289] lstrlenW (lpString="LanmanServer") returned 12 [0280.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0280.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0280.289] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0280.289] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0280.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0280.289] lstrlenW (lpString="LanmanWorkstation") returned 17 [0280.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.289] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0280.289] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0280.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0280.290] lstrlenW (lpString="lmhosts") returned 7 [0280.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0280.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0280.290] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0280.290] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0280.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0280.290] lstrlenW (lpString="MMCSS") returned 5 [0280.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0280.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0280.290] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0280.290] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0280.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0280.290] lstrlenW (lpString="MpsSvc") returned 6 [0280.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0280.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0280.290] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0280.290] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0280.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0280.290] lstrlenW (lpString="Netman") returned 6 [0280.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0280.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0280.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0280.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0280.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0280.290] lstrlenW (lpString="netprofm") returned 8 [0280.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0280.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0280.291] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0280.291] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0280.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0280.296] lstrlenW (lpString="NlaSvc") returned 6 [0280.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0280.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0280.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0280.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0280.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0280.296] lstrlenW (lpString="nsi") returned 3 [0280.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0280.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0280.296] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0280.296] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0280.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0280.296] lstrlenW (lpString="PcaSvc") returned 6 [0280.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0280.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0280.296] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0280.296] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0280.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0280.296] lstrlenW (lpString="PlugPlay") returned 8 [0280.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0280.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0280.296] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0280.296] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0280.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0280.296] lstrlenW (lpString="Power") returned 5 [0280.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0280.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0280.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0280.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0280.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0280.297] lstrlenW (lpString="ProfSvc") returned 7 [0280.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0280.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0280.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0280.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0280.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0280.297] lstrlenW (lpString="RpcEptMapper") returned 12 [0280.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.297] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0280.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0280.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0280.297] lstrlenW (lpString="RpcSs") returned 5 [0280.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0280.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0280.297] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0280.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0280.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0280.297] lstrlenW (lpString="SamSs") returned 5 [0280.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0280.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0280.297] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0280.297] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0280.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0280.298] lstrlenW (lpString="Schedule") returned 8 [0280.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0280.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0280.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0280.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0280.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0280.298] lstrlenW (lpString="SENS") returned 4 [0280.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0280.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0280.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0280.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0280.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0280.298] lstrlenW (lpString="ShellHWDetection") returned 16 [0280.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.298] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0280.298] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0280.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0280.298] lstrlenW (lpString="Spooler") returned 7 [0280.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0280.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0280.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0280.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0280.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0280.298] lstrlenW (lpString="sppsvc") returned 6 [0280.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0280.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0280.298] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0280.298] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0280.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0280.299] lstrlenW (lpString="SysMain") returned 7 [0280.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0280.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0280.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0280.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0280.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0280.299] lstrlenW (lpString="Themes") returned 6 [0280.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0280.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0280.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0280.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0280.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0280.299] lstrlenW (lpString="TrkWks") returned 6 [0280.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0280.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0280.299] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0280.299] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0280.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0280.299] lstrlenW (lpString="UxSms") returned 5 [0280.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0280.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0280.299] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0280.299] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0280.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0280.299] lstrlenW (lpString="VSS") returned 3 [0280.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0280.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0280.299] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0280.300] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0280.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0280.300] lstrlenW (lpString="WdiServiceHost") returned 14 [0280.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0280.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0280.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0280.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0280.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0280.300] lstrlenW (lpString="WdiSystemHost") returned 13 [0280.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0280.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0280.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0280.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0280.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0280.300] lstrlenW (lpString="WinDefend") returned 9 [0280.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0280.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0280.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0280.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0280.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0280.300] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0280.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0280.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0280.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0280.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0280.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0280.300] lstrlenW (lpString="Winmgmt") returned 7 [0280.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0280.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0280.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0280.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0280.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0280.301] lstrlenW (lpString="wscsvc") returned 6 [0280.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0280.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0280.301] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0280.301] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0280.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0280.301] lstrlenW (lpString="wuauserv") returned 8 [0280.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0280.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0280.301] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0280.301] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0280.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0280.301] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39776f8 | out: hHeap=0x2e0000) returned 1 [0280.301] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0280.304] Process32FirstW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.305] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.307] lstrlenW (lpString="System") returned 6 [0280.307] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0280.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0280.307] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0280.307] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0280.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0280.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0280.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0280.307] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.308] lstrlenW (lpString="smss.exe") returned 8 [0280.308] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0280.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0280.308] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.309] lstrlenW (lpString="csrss.exe") returned 9 [0280.309] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.309] lstrlenW (lpString="wininit.exe") returned 11 [0280.310] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.310] lstrlenW (lpString="csrss.exe") returned 9 [0280.310] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.311] lstrlenW (lpString="winlogon.exe") returned 12 [0280.311] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.312] lstrlenW (lpString="services.exe") returned 12 [0280.312] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.313] lstrlenW (lpString="lsass.exe") returned 9 [0280.313] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0280.314] lstrlenW (lpString="lsm.exe") returned 7 [0280.314] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.315] lstrlenW (lpString="svchost.exe") returned 11 [0280.315] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.315] lstrlenW (lpString="svchost.exe") returned 11 [0280.316] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.316] lstrlenW (lpString="svchost.exe") returned 11 [0280.316] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.317] lstrlenW (lpString="svchost.exe") returned 11 [0280.317] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.318] lstrlenW (lpString="svchost.exe") returned 11 [0280.318] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.319] lstrlenW (lpString="audiodg.exe") returned 11 [0280.319] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.320] lstrlenW (lpString="svchost.exe") returned 11 [0280.320] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.321] lstrlenW (lpString="svchost.exe") returned 11 [0280.321] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.322] lstrlenW (lpString="dwm.exe") returned 7 [0280.322] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.322] lstrlenW (lpString="explorer.exe") returned 12 [0280.322] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.323] lstrlenW (lpString="spoolsv.exe") returned 11 [0280.323] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0280.324] lstrlenW (lpString="taskhost.exe") returned 12 [0280.324] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.325] lstrlenW (lpString="svchost.exe") returned 11 [0280.325] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0280.326] lstrlenW (lpString="taskeng.exe") returned 11 [0280.326] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.327] lstrlenW (lpString="svchost.exe") returned 11 [0280.327] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0280.328] lstrlenW (lpString="taskhost.exe") returned 12 [0280.328] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0280.328] lstrlenW (lpString="sppsvc.exe") returned 10 [0280.328] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.329] lstrlenW (lpString="svchost.exe") returned 11 [0280.329] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0280.330] lstrlenW (lpString="push nutrition.exe") returned 18 [0280.330] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0280.331] lstrlenW (lpString="procedures.exe") returned 14 [0280.331] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0280.332] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0280.332] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0280.333] lstrlenW (lpString="scanner-discover.exe") returned 20 [0280.333] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0280.334] lstrlenW (lpString="regression healthcare.exe") returned 25 [0280.334] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0280.334] lstrlenW (lpString="apr_zinc.exe") returned 12 [0280.334] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0280.405] lstrlenW (lpString="computer.exe") returned 12 [0280.405] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0280.406] lstrlenW (lpString="importanceweekend.exe") returned 21 [0280.406] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0280.407] lstrlenW (lpString="warm_absolute.exe") returned 17 [0280.407] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0280.407] lstrlenW (lpString="funding_editing.exe") returned 19 [0280.408] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0280.408] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0280.408] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0280.409] lstrlenW (lpString="friend.exe") returned 10 [0280.409] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0280.410] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0280.410] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0280.410] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0280.410] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0280.411] lstrlenW (lpString="individually_antiques.exe") returned 25 [0280.411] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0280.412] lstrlenW (lpString="embedded.exe") returned 12 [0280.412] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0280.413] lstrlenW (lpString="usually.exe") returned 11 [0280.413] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0280.413] lstrlenW (lpString="bills.exe") returned 9 [0280.413] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0280.414] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0280.414] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0280.415] lstrlenW (lpString="terminal.exe") returned 12 [0280.415] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0280.415] lstrlenW (lpString="ol_refers.exe") returned 13 [0280.415] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0280.416] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0280.416] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0280.417] lstrlenW (lpString="riding analyst.exe") returned 18 [0280.417] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0280.418] lstrlenW (lpString="robots.exe") returned 10 [0280.418] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.418] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0280.418] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0280.419] lstrlenW (lpString="expIorer32.exe") returned 14 [0280.419] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0280.420] lstrlenW (lpString="cmd.exe") returned 7 [0280.420] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0280.420] lstrlenW (lpString="conhost.exe") returned 11 [0280.420] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0280.421] lstrlenW (lpString="vssadmin.exe") returned 12 [0280.421] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0280.422] lstrlenW (lpString="VSSVC.exe") returned 9 [0280.422] Process32NextW (in: hSnapshot=0x204, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0280.422] CloseHandle (hObject=0x204) returned 1 [0280.422] Sleep (dwMilliseconds=0x1f4) [0282.170] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0282.185] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0282.185] GetLastError () returned 0xea [0282.185] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x3f43878 [0282.186] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f43878, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f43878, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0282.186] CloseServiceHandle (hSCObject=0x360140) returned 1 [0282.186] lstrlenW (lpString="Appinfo") returned 7 [0282.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0282.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0282.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0282.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0282.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0282.187] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.187] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.187] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.187] lstrlenW (lpString="AudioSrv") returned 8 [0282.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0282.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0282.187] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0282.187] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0282.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0282.187] lstrlenW (lpString="BFE") returned 3 [0282.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.187] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.187] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.187] lstrlenW (lpString="CryptSvc") returned 8 [0282.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.187] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.187] lstrlenW (lpString="CscService") returned 10 [0282.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0282.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0282.188] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0282.188] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0282.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0282.188] lstrlenW (lpString="DcomLaunch") returned 10 [0282.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.188] lstrlenW (lpString="Dhcp") returned 4 [0282.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.188] lstrlenW (lpString="Dnscache") returned 8 [0282.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.188] lstrlenW (lpString="DPS") returned 3 [0282.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.188] lstrlenW (lpString="eventlog") returned 8 [0282.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0282.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0282.189] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0282.189] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0282.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0282.189] lstrlenW (lpString="EventSystem") returned 11 [0282.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.189] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.189] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.189] lstrlenW (lpString="FontCache") returned 9 [0282.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.189] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.189] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.189] lstrlenW (lpString="gpsvc") returned 5 [0282.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.189] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.189] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.189] lstrlenW (lpString="iphlpsvc") returned 8 [0282.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.189] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.189] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.190] lstrlenW (lpString="LanmanServer") returned 12 [0282.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.190] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.190] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.190] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.190] lstrlenW (lpString="lmhosts") returned 7 [0282.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.190] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.190] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.190] lstrlenW (lpString="MMCSS") returned 5 [0282.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0282.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0282.190] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0282.190] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0282.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0282.190] lstrlenW (lpString="MpsSvc") returned 6 [0282.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.191] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.191] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.191] lstrlenW (lpString="Netman") returned 6 [0282.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0282.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0282.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0282.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0282.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0282.191] lstrlenW (lpString="netprofm") returned 8 [0282.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.191] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.191] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.191] lstrlenW (lpString="NlaSvc") returned 6 [0282.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.191] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.191] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.191] lstrlenW (lpString="nsi") returned 3 [0282.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.191] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.192] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.192] lstrlenW (lpString="PcaSvc") returned 6 [0282.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.192] lstrlenW (lpString="PlugPlay") returned 8 [0282.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.192] lstrlenW (lpString="Power") returned 5 [0282.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.192] lstrlenW (lpString="ProfSvc") returned 7 [0282.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.193] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.193] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.193] lstrlenW (lpString="RpcEptMapper") returned 12 [0282.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.193] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0282.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0282.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0282.193] lstrlenW (lpString="RpcSs") returned 5 [0282.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0282.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0282.193] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0282.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0282.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0282.193] lstrlenW (lpString="SamSs") returned 5 [0282.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0282.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0282.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0282.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0282.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0282.193] lstrlenW (lpString="Schedule") returned 8 [0282.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0282.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0282.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0282.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0282.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0282.193] lstrlenW (lpString="SENS") returned 4 [0282.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0282.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0282.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0282.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0282.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0282.194] lstrlenW (lpString="ShellHWDetection") returned 16 [0282.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0282.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0282.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0282.194] lstrlenW (lpString="Spooler") returned 7 [0282.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0282.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0282.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0282.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0282.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0282.194] lstrlenW (lpString="sppsvc") returned 6 [0282.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0282.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0282.194] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0282.194] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0282.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0282.194] lstrlenW (lpString="swprv") returned 5 [0282.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0282.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0282.194] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0282.194] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0282.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0282.195] lstrlenW (lpString="SysMain") returned 7 [0282.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0282.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0282.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0282.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0282.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0282.195] lstrlenW (lpString="Themes") returned 6 [0282.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0282.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0282.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0282.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0282.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0282.195] lstrlenW (lpString="TrkWks") returned 6 [0282.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0282.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0282.195] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0282.195] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0282.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0282.195] lstrlenW (lpString="UxSms") returned 5 [0282.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0282.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0282.195] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0282.195] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0282.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0282.195] lstrlenW (lpString="VSS") returned 3 [0282.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0282.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0282.195] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0282.196] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0282.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0282.196] lstrlenW (lpString="WdiServiceHost") returned 14 [0282.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0282.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0282.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0282.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0282.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0282.196] lstrlenW (lpString="WdiSystemHost") returned 13 [0282.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0282.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0282.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0282.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0282.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0282.196] lstrlenW (lpString="WinDefend") returned 9 [0282.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0282.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0282.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0282.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0282.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0282.196] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0282.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0282.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0282.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0282.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0282.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0282.196] lstrlenW (lpString="Winmgmt") returned 7 [0282.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0282.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0282.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0282.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0282.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0282.197] lstrlenW (lpString="wscsvc") returned 6 [0282.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0282.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0282.197] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0282.197] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0282.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0282.197] lstrlenW (lpString="wuauserv") returned 8 [0282.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0282.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0282.197] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0282.197] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0282.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0282.197] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f43878 | out: hHeap=0x2e0000) returned 1 [0282.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0282.202] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.203] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.204] lstrlenW (lpString="System") returned 6 [0282.204] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0282.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0282.204] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0282.204] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0282.204] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.205] lstrlenW (lpString="smss.exe") returned 8 [0282.205] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.205] lstrlenW (lpString="csrss.exe") returned 9 [0282.206] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.206] lstrlenW (lpString="wininit.exe") returned 11 [0282.206] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.207] lstrlenW (lpString="csrss.exe") returned 9 [0282.207] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.208] lstrlenW (lpString="winlogon.exe") returned 12 [0282.208] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.209] lstrlenW (lpString="services.exe") returned 12 [0282.209] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.210] lstrlenW (lpString="lsass.exe") returned 9 [0282.210] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0282.211] lstrlenW (lpString="lsm.exe") returned 7 [0282.211] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.212] lstrlenW (lpString="svchost.exe") returned 11 [0282.212] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.213] lstrlenW (lpString="svchost.exe") returned 11 [0282.213] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.213] lstrlenW (lpString="svchost.exe") returned 11 [0282.214] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.214] lstrlenW (lpString="svchost.exe") returned 11 [0282.214] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.215] lstrlenW (lpString="svchost.exe") returned 11 [0282.215] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.216] lstrlenW (lpString="audiodg.exe") returned 11 [0282.216] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.217] lstrlenW (lpString="svchost.exe") returned 11 [0282.217] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.218] lstrlenW (lpString="svchost.exe") returned 11 [0282.218] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.219] lstrlenW (lpString="dwm.exe") returned 7 [0282.219] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.219] lstrlenW (lpString="explorer.exe") returned 12 [0282.220] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.220] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.220] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0282.221] lstrlenW (lpString="taskhost.exe") returned 12 [0282.221] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.222] lstrlenW (lpString="svchost.exe") returned 11 [0282.222] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0282.272] lstrlenW (lpString="taskeng.exe") returned 11 [0282.273] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.274] lstrlenW (lpString="svchost.exe") returned 11 [0282.274] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0282.274] lstrlenW (lpString="taskhost.exe") returned 12 [0282.274] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0282.275] lstrlenW (lpString="sppsvc.exe") returned 10 [0282.275] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.277] lstrlenW (lpString="svchost.exe") returned 11 [0282.277] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0282.279] lstrlenW (lpString="push nutrition.exe") returned 18 [0282.280] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0282.280] lstrlenW (lpString="procedures.exe") returned 14 [0282.280] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0282.281] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0282.281] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0282.282] lstrlenW (lpString="scanner-discover.exe") returned 20 [0282.282] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0282.297] lstrlenW (lpString="regression healthcare.exe") returned 25 [0282.297] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0282.298] lstrlenW (lpString="apr_zinc.exe") returned 12 [0282.298] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0282.300] lstrlenW (lpString="computer.exe") returned 12 [0282.300] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0282.302] lstrlenW (lpString="importanceweekend.exe") returned 21 [0282.302] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0282.302] lstrlenW (lpString="warm_absolute.exe") returned 17 [0282.302] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0282.303] lstrlenW (lpString="funding_editing.exe") returned 19 [0282.303] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0282.304] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0282.304] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0282.306] lstrlenW (lpString="friend.exe") returned 10 [0282.306] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0282.313] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0282.313] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0282.320] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0282.320] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0282.321] lstrlenW (lpString="individually_antiques.exe") returned 25 [0282.321] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0282.322] lstrlenW (lpString="embedded.exe") returned 12 [0282.322] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0282.322] lstrlenW (lpString="usually.exe") returned 11 [0282.323] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0282.323] lstrlenW (lpString="bills.exe") returned 9 [0282.323] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0282.324] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0282.324] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0282.325] lstrlenW (lpString="terminal.exe") returned 12 [0282.336] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0282.354] lstrlenW (lpString="ol_refers.exe") returned 13 [0282.354] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0282.355] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0282.355] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0282.355] lstrlenW (lpString="riding analyst.exe") returned 18 [0282.355] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0282.356] lstrlenW (lpString="robots.exe") returned 10 [0282.356] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0282.357] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0282.357] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0282.358] lstrlenW (lpString="expIorer32.exe") returned 14 [0282.358] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0282.359] lstrlenW (lpString="cmd.exe") returned 7 [0282.359] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0282.360] lstrlenW (lpString="conhost.exe") returned 11 [0282.360] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0282.361] lstrlenW (lpString="vssadmin.exe") returned 12 [0282.361] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0282.362] lstrlenW (lpString="VSSVC.exe") returned 9 [0282.362] Process32NextW (in: hSnapshot=0x1b0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0282.363] CloseHandle (hObject=0x1b0) returned 1 [0282.363] Sleep (dwMilliseconds=0x1f4) [0282.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0282.924] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0282.924] GetLastError () returned 0xea [0282.924] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x3f9c8c0 [0282.924] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f9c8c0, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f9c8c0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0282.925] CloseServiceHandle (hSCObject=0x360140) returned 1 [0282.925] lstrlenW (lpString="Appinfo") returned 7 [0282.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0282.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0282.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0282.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0282.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0282.925] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0282.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0282.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0282.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0282.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0282.925] lstrlenW (lpString="AudioSrv") returned 8 [0282.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0282.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0282.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0282.926] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0282.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0282.926] lstrlenW (lpString="BFE") returned 3 [0282.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0282.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0282.926] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0282.926] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0282.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0282.943] lstrlenW (lpString="CryptSvc") returned 8 [0282.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0282.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0282.943] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0282.943] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0282.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0282.943] lstrlenW (lpString="CscService") returned 10 [0282.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0282.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0282.943] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0282.943] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0282.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0282.943] lstrlenW (lpString="DcomLaunch") returned 10 [0282.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0282.943] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0282.943] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0282.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0282.943] lstrlenW (lpString="Dhcp") returned 4 [0282.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0282.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0282.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0282.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0282.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0282.943] lstrlenW (lpString="Dnscache") returned 8 [0282.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0282.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0282.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0282.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0282.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0282.943] lstrlenW (lpString="DPS") returned 3 [0282.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0282.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0282.944] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0282.944] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0282.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0282.944] lstrlenW (lpString="eventlog") returned 8 [0282.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0282.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0282.944] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0282.944] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0282.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0282.944] lstrlenW (lpString="EventSystem") returned 11 [0282.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0282.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0282.944] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0282.944] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0282.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0282.944] lstrlenW (lpString="FontCache") returned 9 [0282.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0282.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0282.944] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0282.944] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0282.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0282.944] lstrlenW (lpString="gpsvc") returned 5 [0282.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0282.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0282.944] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0282.944] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0282.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0282.944] lstrlenW (lpString="iphlpsvc") returned 8 [0282.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0282.945] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0282.945] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0282.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0282.945] lstrlenW (lpString="LanmanServer") returned 12 [0282.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0282.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0282.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0282.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0282.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0282.945] lstrlenW (lpString="LanmanWorkstation") returned 17 [0282.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0282.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0282.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0282.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0282.945] lstrlenW (lpString="lmhosts") returned 7 [0282.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0282.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0282.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0282.945] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0282.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0282.945] lstrlenW (lpString="MMCSS") returned 5 [0282.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0282.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0282.945] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0282.945] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0282.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0282.945] lstrlenW (lpString="MpsSvc") returned 6 [0282.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0282.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0282.945] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0282.945] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0282.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0282.945] lstrlenW (lpString="Netman") returned 6 [0282.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0282.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0282.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0282.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0282.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0282.946] lstrlenW (lpString="netprofm") returned 8 [0282.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0282.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0282.946] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0282.946] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0282.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0282.946] lstrlenW (lpString="NlaSvc") returned 6 [0282.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0282.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0282.946] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0282.946] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0282.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0282.946] lstrlenW (lpString="nsi") returned 3 [0282.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0282.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0282.946] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0282.946] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0282.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0282.946] lstrlenW (lpString="PcaSvc") returned 6 [0282.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0282.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0282.946] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0282.946] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0282.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0282.946] lstrlenW (lpString="PlugPlay") returned 8 [0282.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0282.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0282.946] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0282.946] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0282.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0282.947] lstrlenW (lpString="Power") returned 5 [0282.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0282.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0282.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0282.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0282.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0282.947] lstrlenW (lpString="ProfSvc") returned 7 [0282.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0282.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0282.947] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0282.947] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0282.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0282.947] lstrlenW (lpString="RpcEptMapper") returned 12 [0282.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0282.947] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0282.947] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0282.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0282.947] lstrlenW (lpString="RpcSs") returned 5 [0282.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0282.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0282.947] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0282.947] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0282.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0282.947] lstrlenW (lpString="SamSs") returned 5 [0282.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0282.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0282.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0282.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0282.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0282.947] lstrlenW (lpString="Schedule") returned 8 [0282.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0282.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0282.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0282.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0282.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0282.948] lstrlenW (lpString="SENS") returned 4 [0282.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0282.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0282.948] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0282.948] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0282.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0282.948] lstrlenW (lpString="ShellHWDetection") returned 16 [0282.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0282.948] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0282.948] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0282.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0282.948] lstrlenW (lpString="Spooler") returned 7 [0282.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0282.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0282.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0282.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0282.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0282.948] lstrlenW (lpString="sppsvc") returned 6 [0282.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0282.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0282.948] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0282.948] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0282.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0282.948] lstrlenW (lpString="swprv") returned 5 [0282.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0282.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0282.949] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0282.949] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0282.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0282.949] lstrlenW (lpString="SysMain") returned 7 [0282.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0282.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0282.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0282.949] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0282.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0282.949] lstrlenW (lpString="Themes") returned 6 [0282.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0282.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0282.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0282.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0282.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0282.949] lstrlenW (lpString="TrkWks") returned 6 [0282.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0282.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0282.949] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0282.949] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0282.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0282.949] lstrlenW (lpString="UxSms") returned 5 [0282.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0282.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0282.949] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0282.949] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0282.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0282.949] lstrlenW (lpString="VSS") returned 3 [0282.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0282.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0282.949] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0282.949] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0282.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0282.950] lstrlenW (lpString="WdiServiceHost") returned 14 [0282.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0282.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0282.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0282.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0282.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0282.950] lstrlenW (lpString="WdiSystemHost") returned 13 [0282.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0282.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0282.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0282.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0282.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0282.950] lstrlenW (lpString="WinDefend") returned 9 [0282.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0282.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0282.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0282.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0282.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0282.950] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0282.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0282.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0282.950] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0282.950] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0282.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0282.950] lstrlenW (lpString="Winmgmt") returned 7 [0282.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0282.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0282.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0282.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0282.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0282.950] lstrlenW (lpString="wscsvc") returned 6 [0282.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0282.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0282.951] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0282.951] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0282.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0282.951] lstrlenW (lpString="wuauserv") returned 8 [0282.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0282.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0282.951] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0282.951] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0282.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0282.951] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f9c8c0 | out: hHeap=0x2e0000) returned 1 [0282.951] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0282.953] Process32FirstW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.954] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0282.954] lstrlenW (lpString="System") returned 6 [0282.954] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0282.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0282.954] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0282.954] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0282.954] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0282.955] lstrlenW (lpString="smss.exe") returned 8 [0282.955] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.956] lstrlenW (lpString="csrss.exe") returned 9 [0282.956] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0282.957] lstrlenW (lpString="wininit.exe") returned 11 [0282.957] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0282.957] lstrlenW (lpString="csrss.exe") returned 9 [0282.957] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0282.958] lstrlenW (lpString="winlogon.exe") returned 12 [0282.958] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0282.959] lstrlenW (lpString="services.exe") returned 12 [0282.959] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0282.959] lstrlenW (lpString="lsass.exe") returned 9 [0282.959] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0282.960] lstrlenW (lpString="lsm.exe") returned 7 [0282.960] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.961] lstrlenW (lpString="svchost.exe") returned 11 [0282.961] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.961] lstrlenW (lpString="svchost.exe") returned 11 [0282.962] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.962] lstrlenW (lpString="svchost.exe") returned 11 [0282.962] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.963] lstrlenW (lpString="svchost.exe") returned 11 [0282.963] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.964] lstrlenW (lpString="svchost.exe") returned 11 [0282.964] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0282.964] lstrlenW (lpString="audiodg.exe") returned 11 [0282.964] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.965] lstrlenW (lpString="svchost.exe") returned 11 [0282.965] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.966] lstrlenW (lpString="svchost.exe") returned 11 [0282.966] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0282.966] lstrlenW (lpString="dwm.exe") returned 7 [0282.966] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0282.967] lstrlenW (lpString="explorer.exe") returned 12 [0282.967] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0282.968] lstrlenW (lpString="spoolsv.exe") returned 11 [0282.968] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0282.968] lstrlenW (lpString="taskhost.exe") returned 12 [0282.968] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.969] lstrlenW (lpString="svchost.exe") returned 11 [0282.969] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0282.970] lstrlenW (lpString="taskeng.exe") returned 11 [0282.970] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.970] lstrlenW (lpString="svchost.exe") returned 11 [0282.970] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0282.971] lstrlenW (lpString="taskhost.exe") returned 12 [0282.971] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0282.972] lstrlenW (lpString="sppsvc.exe") returned 10 [0282.972] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0282.972] lstrlenW (lpString="svchost.exe") returned 11 [0282.972] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0282.973] lstrlenW (lpString="push nutrition.exe") returned 18 [0282.973] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0282.974] lstrlenW (lpString="procedures.exe") returned 14 [0282.974] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0282.975] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0282.975] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0282.976] lstrlenW (lpString="scanner-discover.exe") returned 20 [0282.976] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0282.976] lstrlenW (lpString="regression healthcare.exe") returned 25 [0282.976] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0282.977] lstrlenW (lpString="apr_zinc.exe") returned 12 [0282.977] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0282.978] lstrlenW (lpString="computer.exe") returned 12 [0282.978] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0282.979] lstrlenW (lpString="importanceweekend.exe") returned 21 [0282.979] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0282.979] lstrlenW (lpString="warm_absolute.exe") returned 17 [0282.979] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0282.980] lstrlenW (lpString="funding_editing.exe") returned 19 [0282.980] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0282.981] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0282.981] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0282.982] lstrlenW (lpString="friend.exe") returned 10 [0282.982] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0283.119] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0283.119] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0283.120] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0283.120] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0283.121] lstrlenW (lpString="individually_antiques.exe") returned 25 [0283.121] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0283.122] lstrlenW (lpString="embedded.exe") returned 12 [0283.122] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0283.123] lstrlenW (lpString="usually.exe") returned 11 [0283.123] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0283.123] lstrlenW (lpString="bills.exe") returned 9 [0283.124] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0283.130] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0283.130] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0283.130] lstrlenW (lpString="terminal.exe") returned 12 [0283.130] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0283.131] lstrlenW (lpString="ol_refers.exe") returned 13 [0283.131] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0283.132] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0283.132] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0283.133] lstrlenW (lpString="riding analyst.exe") returned 18 [0283.133] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0283.133] lstrlenW (lpString="robots.exe") returned 10 [0283.133] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.134] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0283.134] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0283.135] lstrlenW (lpString="expIorer32.exe") returned 14 [0283.135] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.136] lstrlenW (lpString="cmd.exe") returned 7 [0283.136] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.136] lstrlenW (lpString="conhost.exe") returned 11 [0283.136] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0283.137] lstrlenW (lpString="vssadmin.exe") returned 12 [0283.137] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0283.138] lstrlenW (lpString="VSSVC.exe") returned 9 [0283.138] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.139] lstrlenW (lpString="svchost.exe") returned 11 [0283.139] Process32NextW (in: hSnapshot=0x218, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0283.140] CloseHandle (hObject=0x218) returned 1 [0283.140] Sleep (dwMilliseconds=0x1f4) [0283.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360208 [0283.683] EnumServicesStatusExW (in: hSCManager=0x360208, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0283.683] GetLastError () returned 0xea [0283.683] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x4024900 [0283.683] EnumServicesStatusExW (in: hSCManager=0x360208, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4024900, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4024900, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0283.684] CloseServiceHandle (hSCObject=0x360208) returned 1 [0283.684] lstrlenW (lpString="Appinfo") returned 7 [0283.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0283.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0283.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0283.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0283.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0283.684] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0283.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0283.684] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0283.684] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0283.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0283.684] lstrlenW (lpString="AudioSrv") returned 8 [0283.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0283.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0283.684] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0283.684] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0283.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0283.685] lstrlenW (lpString="BFE") returned 3 [0283.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0283.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0283.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0283.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0283.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0283.685] lstrlenW (lpString="CryptSvc") returned 8 [0283.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0283.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0283.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0283.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0283.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0283.685] lstrlenW (lpString="CscService") returned 10 [0283.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0283.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0283.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0283.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0283.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0283.685] lstrlenW (lpString="DcomLaunch") returned 10 [0283.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0283.685] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0283.685] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0283.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0283.685] lstrlenW (lpString="Dhcp") returned 4 [0283.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0283.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0283.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0283.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0283.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0283.686] lstrlenW (lpString="Dnscache") returned 8 [0283.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0283.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0283.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0283.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0283.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0283.686] lstrlenW (lpString="DPS") returned 3 [0283.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0283.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0283.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0283.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0283.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0283.686] lstrlenW (lpString="eventlog") returned 8 [0283.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0283.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0283.686] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0283.686] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0283.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0283.686] lstrlenW (lpString="EventSystem") returned 11 [0283.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0283.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0283.686] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0283.686] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0283.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0283.686] lstrlenW (lpString="FontCache") returned 9 [0283.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0283.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0283.687] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0283.687] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0283.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0283.687] lstrlenW (lpString="gpsvc") returned 5 [0283.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0283.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0283.687] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0283.687] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0283.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0283.687] lstrlenW (lpString="iphlpsvc") returned 8 [0283.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0283.687] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0283.687] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0283.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0283.687] lstrlenW (lpString="LanmanServer") returned 12 [0283.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0283.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0283.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0283.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0283.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0283.687] lstrlenW (lpString="LanmanWorkstation") returned 17 [0283.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0283.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0283.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0283.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0283.688] lstrlenW (lpString="lmhosts") returned 7 [0283.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0283.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0283.688] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0283.688] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0283.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0283.688] lstrlenW (lpString="MMCSS") returned 5 [0283.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0283.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0283.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0283.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0283.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0283.688] lstrlenW (lpString="MpsSvc") returned 6 [0283.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0283.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0283.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0283.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0283.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0283.688] lstrlenW (lpString="Netman") returned 6 [0283.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0283.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0283.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0283.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0283.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0283.688] lstrlenW (lpString="netprofm") returned 8 [0283.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0283.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0283.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0283.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0283.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0283.689] lstrlenW (lpString="NlaSvc") returned 6 [0283.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0283.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0283.689] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0283.689] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0283.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0283.689] lstrlenW (lpString="nsi") returned 3 [0283.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0283.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0283.689] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0283.689] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0283.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0283.689] lstrlenW (lpString="PcaSvc") returned 6 [0283.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0283.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0283.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0283.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0283.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0283.689] lstrlenW (lpString="PlugPlay") returned 8 [0283.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0283.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0283.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0283.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0283.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0283.690] lstrlenW (lpString="Power") returned 5 [0283.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0283.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0283.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0283.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0283.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0283.690] lstrlenW (lpString="ProfSvc") returned 7 [0283.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0283.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0283.690] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0283.690] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0283.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0283.690] lstrlenW (lpString="RpcEptMapper") returned 12 [0283.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0283.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0283.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0283.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0283.690] lstrlenW (lpString="RpcSs") returned 5 [0283.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0283.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0283.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0283.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0283.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0283.690] lstrlenW (lpString="SamSs") returned 5 [0283.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0283.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0283.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0283.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0283.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0283.690] lstrlenW (lpString="Schedule") returned 8 [0283.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0283.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0283.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0283.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0283.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0283.691] lstrlenW (lpString="SENS") returned 4 [0283.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0283.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0283.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0283.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0283.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0283.691] lstrlenW (lpString="ShellHWDetection") returned 16 [0283.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0283.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0283.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0283.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0283.691] lstrlenW (lpString="Spooler") returned 7 [0283.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0283.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0283.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0283.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0283.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0283.691] lstrlenW (lpString="sppsvc") returned 6 [0283.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0283.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0283.691] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0283.691] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0283.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0283.691] lstrlenW (lpString="swprv") returned 5 [0283.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0283.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0283.691] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0283.692] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0283.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0283.692] lstrlenW (lpString="SysMain") returned 7 [0283.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0283.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0283.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0283.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0283.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0283.692] lstrlenW (lpString="Themes") returned 6 [0283.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0283.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0283.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0283.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0283.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0283.692] lstrlenW (lpString="TrkWks") returned 6 [0283.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0283.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0283.692] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0283.692] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0283.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0283.692] lstrlenW (lpString="UxSms") returned 5 [0283.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0283.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0283.692] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0283.692] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0283.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0283.692] lstrlenW (lpString="VSS") returned 3 [0283.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0283.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0283.692] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0283.692] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0283.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0283.692] lstrlenW (lpString="WdiServiceHost") returned 14 [0283.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0283.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0283.693] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0283.693] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0283.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0283.693] lstrlenW (lpString="WdiSystemHost") returned 13 [0283.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0283.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0283.693] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0283.693] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0283.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0283.693] lstrlenW (lpString="WinDefend") returned 9 [0283.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0283.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0283.693] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0283.693] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0283.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0283.693] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0283.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0283.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0283.693] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0283.693] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0283.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0283.693] lstrlenW (lpString="Winmgmt") returned 7 [0283.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0283.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0283.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0283.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0283.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0283.694] lstrlenW (lpString="wscsvc") returned 6 [0283.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0283.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0283.694] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0283.694] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0283.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0283.694] lstrlenW (lpString="wuauserv") returned 8 [0283.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0283.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0283.694] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0283.694] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0283.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0283.694] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x4024900 | out: hHeap=0x2e0000) returned 1 [0283.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0283.697] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.698] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0283.698] lstrlenW (lpString="System") returned 6 [0283.698] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0283.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0283.698] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0283.699] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0283.699] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0283.699] lstrlenW (lpString="smss.exe") returned 8 [0283.700] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.700] lstrlenW (lpString="csrss.exe") returned 9 [0283.700] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0283.701] lstrlenW (lpString="wininit.exe") returned 11 [0283.701] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0283.702] lstrlenW (lpString="csrss.exe") returned 9 [0283.702] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0283.703] lstrlenW (lpString="winlogon.exe") returned 12 [0283.703] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0283.704] lstrlenW (lpString="services.exe") returned 12 [0283.704] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0283.705] lstrlenW (lpString="lsass.exe") returned 9 [0283.705] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0283.706] lstrlenW (lpString="lsm.exe") returned 7 [0283.706] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.710] lstrlenW (lpString="svchost.exe") returned 11 [0283.710] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.711] lstrlenW (lpString="svchost.exe") returned 11 [0283.711] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.712] lstrlenW (lpString="svchost.exe") returned 11 [0283.712] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.713] lstrlenW (lpString="svchost.exe") returned 11 [0283.713] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.714] lstrlenW (lpString="svchost.exe") returned 11 [0283.714] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0283.715] lstrlenW (lpString="audiodg.exe") returned 11 [0283.715] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.716] lstrlenW (lpString="svchost.exe") returned 11 [0283.716] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.717] lstrlenW (lpString="svchost.exe") returned 11 [0283.717] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0283.718] lstrlenW (lpString="dwm.exe") returned 7 [0283.718] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0283.719] lstrlenW (lpString="explorer.exe") returned 12 [0283.719] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0283.720] lstrlenW (lpString="spoolsv.exe") returned 11 [0283.720] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0283.773] lstrlenW (lpString="taskhost.exe") returned 12 [0283.773] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.774] lstrlenW (lpString="svchost.exe") returned 11 [0283.774] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0283.775] lstrlenW (lpString="taskeng.exe") returned 11 [0283.775] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.776] lstrlenW (lpString="svchost.exe") returned 11 [0283.776] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0283.777] lstrlenW (lpString="taskhost.exe") returned 12 [0283.777] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0283.848] lstrlenW (lpString="sppsvc.exe") returned 10 [0283.848] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.849] lstrlenW (lpString="svchost.exe") returned 11 [0283.849] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0283.850] lstrlenW (lpString="push nutrition.exe") returned 18 [0283.850] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0283.851] lstrlenW (lpString="procedures.exe") returned 14 [0283.851] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0283.852] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0283.852] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0283.852] lstrlenW (lpString="scanner-discover.exe") returned 20 [0283.852] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0283.853] lstrlenW (lpString="regression healthcare.exe") returned 25 [0283.853] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0283.854] lstrlenW (lpString="apr_zinc.exe") returned 12 [0283.854] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0283.854] lstrlenW (lpString="computer.exe") returned 12 [0283.854] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0283.855] lstrlenW (lpString="importanceweekend.exe") returned 21 [0283.855] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0283.856] lstrlenW (lpString="warm_absolute.exe") returned 17 [0283.856] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0283.856] lstrlenW (lpString="funding_editing.exe") returned 19 [0283.856] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0283.857] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0283.857] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0283.858] lstrlenW (lpString="friend.exe") returned 10 [0283.858] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0283.858] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0283.858] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0283.859] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0283.859] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0283.860] lstrlenW (lpString="individually_antiques.exe") returned 25 [0283.860] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0283.860] lstrlenW (lpString="embedded.exe") returned 12 [0283.860] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0283.861] lstrlenW (lpString="usually.exe") returned 11 [0283.861] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0283.862] lstrlenW (lpString="bills.exe") returned 9 [0283.862] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0283.863] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0283.863] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0283.863] lstrlenW (lpString="terminal.exe") returned 12 [0283.863] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0283.864] lstrlenW (lpString="ol_refers.exe") returned 13 [0283.864] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0283.865] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0283.865] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0283.865] lstrlenW (lpString="riding analyst.exe") returned 18 [0283.866] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0283.866] lstrlenW (lpString="robots.exe") returned 10 [0283.866] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0283.867] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0283.867] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0283.868] lstrlenW (lpString="expIorer32.exe") returned 14 [0283.868] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0283.868] lstrlenW (lpString="cmd.exe") returned 7 [0283.868] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0283.869] lstrlenW (lpString="conhost.exe") returned 11 [0283.869] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0283.870] lstrlenW (lpString="vssadmin.exe") returned 12 [0283.870] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0283.870] lstrlenW (lpString="VSSVC.exe") returned 9 [0283.870] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0283.871] lstrlenW (lpString="svchost.exe") returned 11 [0283.871] Process32NextW (in: hSnapshot=0x1f0, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0283.872] CloseHandle (hObject=0x1f0) returned 1 [0283.872] Sleep (dwMilliseconds=0x1f4) [0284.483] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x360140 [0284.483] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0284.483] GetLastError () returned 0xea [0284.483] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x4024900 [0284.483] EnumServicesStatusExW (in: hSCManager=0x360140, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4024900, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4024900, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0284.484] CloseServiceHandle (hSCObject=0x360140) returned 1 [0284.484] lstrlenW (lpString="Appinfo") returned 7 [0284.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0284.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0284.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0284.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0284.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0284.485] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0284.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0284.485] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0284.485] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0284.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0284.485] lstrlenW (lpString="AudioSrv") returned 8 [0284.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0284.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0284.485] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0284.485] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0284.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0284.485] lstrlenW (lpString="BFE") returned 3 [0284.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0284.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0284.485] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0284.485] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0284.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0284.485] lstrlenW (lpString="CryptSvc") returned 8 [0284.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0284.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0284.486] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0284.486] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0284.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0284.486] lstrlenW (lpString="CscService") returned 10 [0284.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0284.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0284.486] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0284.486] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0284.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0284.486] lstrlenW (lpString="DcomLaunch") returned 10 [0284.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0284.486] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0284.486] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0284.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0284.486] lstrlenW (lpString="Dhcp") returned 4 [0284.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0284.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0284.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0284.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0284.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0284.486] lstrlenW (lpString="Dnscache") returned 8 [0284.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0284.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0284.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0284.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0284.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0284.487] lstrlenW (lpString="DPS") returned 3 [0284.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0284.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0284.487] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0284.487] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0284.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0284.487] lstrlenW (lpString="eventlog") returned 8 [0284.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0284.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0284.487] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0284.487] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0284.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0284.487] lstrlenW (lpString="EventSystem") returned 11 [0284.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0284.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0284.487] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0284.487] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0284.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0284.487] lstrlenW (lpString="FontCache") returned 9 [0284.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0284.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0284.487] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0284.487] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0284.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0284.487] lstrlenW (lpString="gpsvc") returned 5 [0284.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0284.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0284.488] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0284.488] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0284.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0284.488] lstrlenW (lpString="iphlpsvc") returned 8 [0284.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0284.488] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0284.488] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0284.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0284.488] lstrlenW (lpString="LanmanServer") returned 12 [0284.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0284.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0284.488] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0284.488] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0284.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0284.488] lstrlenW (lpString="LanmanWorkstation") returned 17 [0284.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0284.488] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0284.488] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0284.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0284.488] lstrlenW (lpString="lmhosts") returned 7 [0284.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0284.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0284.488] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0284.488] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0284.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0284.488] lstrlenW (lpString="MMCSS") returned 5 [0284.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0284.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0284.489] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0284.489] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0284.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0284.489] lstrlenW (lpString="MpsSvc") returned 6 [0284.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0284.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0284.489] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0284.489] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0284.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0284.489] lstrlenW (lpString="Netman") returned 6 [0284.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0284.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0284.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0284.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0284.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0284.489] lstrlenW (lpString="netprofm") returned 8 [0284.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0284.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0284.489] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0284.489] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0284.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0284.489] lstrlenW (lpString="NlaSvc") returned 6 [0284.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0284.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0284.489] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0284.490] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0284.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0284.490] lstrlenW (lpString="nsi") returned 3 [0284.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0284.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0284.490] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0284.490] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0284.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0284.490] lstrlenW (lpString="PcaSvc") returned 6 [0284.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0284.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0284.490] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0284.490] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0284.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0284.490] lstrlenW (lpString="PlugPlay") returned 8 [0284.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0284.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0284.490] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0284.490] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0284.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0284.490] lstrlenW (lpString="Power") returned 5 [0284.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0284.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0284.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0284.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0284.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0284.490] lstrlenW (lpString="ProfSvc") returned 7 [0284.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0284.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0284.491] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0284.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0284.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0284.491] lstrlenW (lpString="RpcEptMapper") returned 12 [0284.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0284.491] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0284.491] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0284.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0284.491] lstrlenW (lpString="RpcSs") returned 5 [0284.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0284.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0284.491] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0284.491] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0284.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0284.491] lstrlenW (lpString="SamSs") returned 5 [0284.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0284.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0284.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0284.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0284.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0284.491] lstrlenW (lpString="Schedule") returned 8 [0284.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0284.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0284.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0284.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0284.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0284.492] lstrlenW (lpString="SENS") returned 4 [0284.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0284.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0284.492] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0284.492] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0284.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0284.492] lstrlenW (lpString="ShellHWDetection") returned 16 [0284.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0284.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0284.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0284.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0284.492] lstrlenW (lpString="Spooler") returned 7 [0284.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0284.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0284.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0284.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0284.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0284.492] lstrlenW (lpString="sppsvc") returned 6 [0284.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0284.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0284.492] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0284.492] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0284.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0284.492] lstrlenW (lpString="swprv") returned 5 [0284.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0284.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0284.493] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0284.493] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0284.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0284.493] lstrlenW (lpString="SysMain") returned 7 [0284.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0284.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0284.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0284.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0284.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0284.493] lstrlenW (lpString="Themes") returned 6 [0284.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0284.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0284.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0284.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0284.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0284.493] lstrlenW (lpString="TrkWks") returned 6 [0284.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0284.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0284.493] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0284.493] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0284.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0284.493] lstrlenW (lpString="UxSms") returned 5 [0284.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0284.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0284.493] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0284.493] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0284.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0284.494] lstrlenW (lpString="VSS") returned 3 [0284.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0284.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0284.494] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0284.494] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0284.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0284.494] lstrlenW (lpString="WdiServiceHost") returned 14 [0284.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0284.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0284.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0284.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0284.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0284.494] lstrlenW (lpString="WdiSystemHost") returned 13 [0284.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0284.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0284.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0284.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0284.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0284.494] lstrlenW (lpString="WinDefend") returned 9 [0284.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0284.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0284.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0284.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0284.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0284.494] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0284.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0284.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0284.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0284.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0284.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0284.495] lstrlenW (lpString="Winmgmt") returned 7 [0284.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0284.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0284.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0284.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0284.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0284.495] lstrlenW (lpString="wscsvc") returned 6 [0284.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0284.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0284.495] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0284.495] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0284.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0284.495] lstrlenW (lpString="wuauserv") returned 8 [0284.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0284.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0284.495] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0284.495] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0284.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0284.495] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x4024900 | out: hHeap=0x2e0000) returned 1 [0284.495] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0284.499] Process32FirstW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.503] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0284.507] lstrlenW (lpString="System") returned 6 [0284.507] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0284.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0284.508] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0284.508] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0284.508] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0284.509] lstrlenW (lpString="smss.exe") returned 8 [0284.509] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.510] lstrlenW (lpString="csrss.exe") returned 9 [0284.511] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0284.511] lstrlenW (lpString="wininit.exe") returned 11 [0284.512] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0284.517] lstrlenW (lpString="csrss.exe") returned 9 [0284.517] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0284.519] lstrlenW (lpString="winlogon.exe") returned 12 [0284.519] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0284.520] lstrlenW (lpString="services.exe") returned 12 [0284.520] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0284.521] lstrlenW (lpString="lsass.exe") returned 9 [0284.521] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0284.522] lstrlenW (lpString="lsm.exe") returned 7 [0284.522] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.523] lstrlenW (lpString="svchost.exe") returned 11 [0284.523] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.524] lstrlenW (lpString="svchost.exe") returned 11 [0284.524] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.525] lstrlenW (lpString="svchost.exe") returned 11 [0284.525] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.526] lstrlenW (lpString="svchost.exe") returned 11 [0284.526] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.527] lstrlenW (lpString="svchost.exe") returned 11 [0284.527] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0284.528] lstrlenW (lpString="audiodg.exe") returned 11 [0284.528] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.529] lstrlenW (lpString="svchost.exe") returned 11 [0284.529] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.591] lstrlenW (lpString="svchost.exe") returned 11 [0284.591] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0284.592] lstrlenW (lpString="dwm.exe") returned 7 [0284.592] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0284.592] lstrlenW (lpString="explorer.exe") returned 12 [0284.592] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0284.593] lstrlenW (lpString="spoolsv.exe") returned 11 [0284.593] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0284.594] lstrlenW (lpString="taskhost.exe") returned 12 [0284.594] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.594] lstrlenW (lpString="svchost.exe") returned 11 [0284.594] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0284.596] lstrlenW (lpString="taskeng.exe") returned 11 [0284.596] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.597] lstrlenW (lpString="svchost.exe") returned 11 [0284.597] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0284.598] lstrlenW (lpString="taskhost.exe") returned 12 [0284.598] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0284.598] lstrlenW (lpString="sppsvc.exe") returned 10 [0284.599] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.599] lstrlenW (lpString="svchost.exe") returned 11 [0284.599] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0284.600] lstrlenW (lpString="push nutrition.exe") returned 18 [0284.600] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0284.602] lstrlenW (lpString="procedures.exe") returned 14 [0284.602] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0284.603] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0284.603] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0284.603] lstrlenW (lpString="scanner-discover.exe") returned 20 [0284.603] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0284.604] lstrlenW (lpString="regression healthcare.exe") returned 25 [0284.604] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0284.605] lstrlenW (lpString="apr_zinc.exe") returned 12 [0284.605] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0284.607] lstrlenW (lpString="computer.exe") returned 12 [0284.607] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0284.607] lstrlenW (lpString="importanceweekend.exe") returned 21 [0284.607] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0284.608] lstrlenW (lpString="warm_absolute.exe") returned 17 [0284.608] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0284.610] lstrlenW (lpString="funding_editing.exe") returned 19 [0284.610] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0284.611] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0284.611] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0284.612] lstrlenW (lpString="friend.exe") returned 10 [0284.612] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0284.612] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0284.612] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0284.613] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0284.613] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0284.614] lstrlenW (lpString="individually_antiques.exe") returned 25 [0284.614] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0284.615] lstrlenW (lpString="embedded.exe") returned 12 [0284.615] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0284.616] lstrlenW (lpString="usually.exe") returned 11 [0284.616] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0284.616] lstrlenW (lpString="bills.exe") returned 9 [0284.616] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0284.617] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0284.617] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0284.618] lstrlenW (lpString="terminal.exe") returned 12 [0284.618] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0284.618] lstrlenW (lpString="ol_refers.exe") returned 13 [0284.619] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0284.620] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0284.620] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0284.621] lstrlenW (lpString="riding analyst.exe") returned 18 [0284.621] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0284.621] lstrlenW (lpString="robots.exe") returned 10 [0284.622] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0284.622] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0284.622] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0284.623] lstrlenW (lpString="expIorer32.exe") returned 14 [0284.623] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0284.624] lstrlenW (lpString="cmd.exe") returned 7 [0284.624] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0284.624] lstrlenW (lpString="conhost.exe") returned 11 [0284.624] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0284.625] lstrlenW (lpString="vssadmin.exe") returned 12 [0284.625] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0284.626] lstrlenW (lpString="VSSVC.exe") returned 9 [0284.626] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0284.627] lstrlenW (lpString="svchost.exe") returned 11 [0284.627] Process32NextW (in: hSnapshot=0x208, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0284.628] CloseHandle (hObject=0x208) returned 1 [0284.629] Sleep (dwMilliseconds=0x1f4) [0285.158] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fce0 [0285.158] EnumServicesStatusExW (in: hSCManager=0x35fce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0285.159] GetLastError () returned 0xea [0285.159] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x3ef1860 [0285.159] EnumServicesStatusExW (in: hSCManager=0x35fce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef1860, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef1860, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0285.160] CloseServiceHandle (hSCObject=0x35fce0) returned 1 [0285.160] lstrlenW (lpString="Appinfo") returned 7 [0285.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0285.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0285.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0285.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0285.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0285.160] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.201] lstrlenW (lpString="AudioSrv") returned 8 [0285.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0285.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0285.201] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0285.201] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0285.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0285.201] lstrlenW (lpString="BFE") returned 3 [0285.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.201] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.201] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.202] lstrlenW (lpString="CryptSvc") returned 8 [0285.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.202] lstrlenW (lpString="CscService") returned 10 [0285.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0285.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0285.202] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0285.202] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0285.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0285.202] lstrlenW (lpString="DcomLaunch") returned 10 [0285.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.202] lstrlenW (lpString="Dhcp") returned 4 [0285.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.202] lstrlenW (lpString="Dnscache") returned 8 [0285.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.204] lstrlenW (lpString="DPS") returned 3 [0285.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.204] lstrlenW (lpString="eventlog") returned 8 [0285.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0285.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0285.204] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0285.204] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0285.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0285.204] lstrlenW (lpString="EventSystem") returned 11 [0285.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.204] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.204] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.204] lstrlenW (lpString="FontCache") returned 9 [0285.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.204] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.204] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.204] lstrlenW (lpString="gpsvc") returned 5 [0285.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.205] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.205] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.205] lstrlenW (lpString="iphlpsvc") returned 8 [0285.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.205] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.205] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.205] lstrlenW (lpString="LanmanServer") returned 12 [0285.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.205] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.205] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.205] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.205] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.205] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.205] lstrlenW (lpString="lmhosts") returned 7 [0285.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.205] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.205] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.205] lstrlenW (lpString="MMCSS") returned 5 [0285.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0285.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0285.205] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0285.205] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0285.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0285.205] lstrlenW (lpString="MpsSvc") returned 6 [0285.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.206] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.206] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.206] lstrlenW (lpString="Netman") returned 6 [0285.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0285.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0285.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0285.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0285.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0285.206] lstrlenW (lpString="netprofm") returned 8 [0285.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.206] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.206] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.206] lstrlenW (lpString="NlaSvc") returned 6 [0285.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.206] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.206] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.206] lstrlenW (lpString="nsi") returned 3 [0285.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.206] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.206] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.206] lstrlenW (lpString="PcaSvc") returned 6 [0285.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.206] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.206] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.207] lstrlenW (lpString="PlugPlay") returned 8 [0285.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.207] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.207] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.207] lstrlenW (lpString="Power") returned 5 [0285.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.207] lstrlenW (lpString="ProfSvc") returned 7 [0285.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.207] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.207] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.207] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.207] lstrlenW (lpString="RpcSs") returned 5 [0285.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.207] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.207] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.208] lstrlenW (lpString="SamSs") returned 5 [0285.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.208] lstrlenW (lpString="Schedule") returned 8 [0285.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.208] lstrlenW (lpString="SENS") returned 4 [0285.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.208] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.208] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.208] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.208] lstrlenW (lpString="Spooler") returned 7 [0285.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.209] lstrlenW (lpString="sppsvc") returned 6 [0285.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0285.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0285.209] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0285.209] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0285.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0285.209] lstrlenW (lpString="swprv") returned 5 [0285.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0285.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0285.209] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0285.209] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0285.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0285.209] lstrlenW (lpString="SysMain") returned 7 [0285.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.209] lstrlenW (lpString="Themes") returned 6 [0285.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0285.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0285.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0285.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0285.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0285.209] lstrlenW (lpString="TrkWks") returned 6 [0285.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0285.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0285.209] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0285.209] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0285.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0285.209] lstrlenW (lpString="UxSms") returned 5 [0285.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0285.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0285.209] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0285.209] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0285.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0285.210] lstrlenW (lpString="VSS") returned 3 [0285.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0285.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0285.210] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0285.210] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0285.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0285.210] lstrlenW (lpString="WdiServiceHost") returned 14 [0285.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0285.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0285.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0285.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0285.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0285.210] lstrlenW (lpString="WdiSystemHost") returned 13 [0285.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0285.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0285.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0285.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0285.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0285.210] lstrlenW (lpString="WinDefend") returned 9 [0285.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0285.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0285.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0285.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0285.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0285.210] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0285.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0285.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0285.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0285.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0285.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0285.210] lstrlenW (lpString="Winmgmt") returned 7 [0285.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0285.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0285.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0285.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0285.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0285.211] lstrlenW (lpString="wscsvc") returned 6 [0285.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0285.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0285.211] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0285.211] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0285.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0285.211] lstrlenW (lpString="wuauserv") returned 8 [0285.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0285.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0285.211] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0285.211] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0285.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0285.211] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ef1860 | out: hHeap=0x2e0000) returned 1 [0285.211] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0285.213] Process32FirstW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.214] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.214] lstrlenW (lpString="System") returned 6 [0285.214] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0285.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0285.214] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0285.215] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0285.215] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.215] lstrlenW (lpString="smss.exe") returned 8 [0285.215] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.216] lstrlenW (lpString="csrss.exe") returned 9 [0285.216] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.223] lstrlenW (lpString="wininit.exe") returned 11 [0285.223] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.224] lstrlenW (lpString="csrss.exe") returned 9 [0285.224] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.225] lstrlenW (lpString="winlogon.exe") returned 12 [0285.225] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.226] lstrlenW (lpString="services.exe") returned 12 [0285.226] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.226] lstrlenW (lpString="lsass.exe") returned 9 [0285.226] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0285.227] lstrlenW (lpString="lsm.exe") returned 7 [0285.227] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.228] lstrlenW (lpString="svchost.exe") returned 11 [0285.228] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.228] lstrlenW (lpString="svchost.exe") returned 11 [0285.229] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.229] lstrlenW (lpString="svchost.exe") returned 11 [0285.229] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.230] lstrlenW (lpString="svchost.exe") returned 11 [0285.230] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.231] lstrlenW (lpString="svchost.exe") returned 11 [0285.231] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.231] lstrlenW (lpString="audiodg.exe") returned 11 [0285.231] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.232] lstrlenW (lpString="svchost.exe") returned 11 [0285.232] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.233] lstrlenW (lpString="svchost.exe") returned 11 [0285.233] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.234] lstrlenW (lpString="dwm.exe") returned 7 [0285.236] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.237] lstrlenW (lpString="explorer.exe") returned 12 [0285.237] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.237] lstrlenW (lpString="spoolsv.exe") returned 11 [0285.237] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0285.238] lstrlenW (lpString="taskhost.exe") returned 12 [0285.238] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.239] lstrlenW (lpString="svchost.exe") returned 11 [0285.239] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0285.239] lstrlenW (lpString="taskeng.exe") returned 11 [0285.239] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.240] lstrlenW (lpString="svchost.exe") returned 11 [0285.240] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0285.241] lstrlenW (lpString="taskhost.exe") returned 12 [0285.241] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0285.242] lstrlenW (lpString="sppsvc.exe") returned 10 [0285.242] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.242] lstrlenW (lpString="svchost.exe") returned 11 [0285.242] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0285.243] lstrlenW (lpString="push nutrition.exe") returned 18 [0285.243] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0285.244] lstrlenW (lpString="procedures.exe") returned 14 [0285.244] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0285.244] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0285.245] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0285.245] lstrlenW (lpString="scanner-discover.exe") returned 20 [0285.245] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0285.246] lstrlenW (lpString="regression healthcare.exe") returned 25 [0285.246] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0285.247] lstrlenW (lpString="apr_zinc.exe") returned 12 [0285.247] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0285.271] lstrlenW (lpString="computer.exe") returned 12 [0285.271] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0285.272] lstrlenW (lpString="importanceweekend.exe") returned 21 [0285.272] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0285.273] lstrlenW (lpString="warm_absolute.exe") returned 17 [0285.273] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0285.273] lstrlenW (lpString="funding_editing.exe") returned 19 [0285.273] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0285.274] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0285.274] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0285.275] lstrlenW (lpString="friend.exe") returned 10 [0285.275] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0285.275] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0285.275] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0285.276] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0285.276] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0285.277] lstrlenW (lpString="individually_antiques.exe") returned 25 [0285.277] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0285.277] lstrlenW (lpString="embedded.exe") returned 12 [0285.277] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0285.278] lstrlenW (lpString="usually.exe") returned 11 [0285.278] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0285.279] lstrlenW (lpString="bills.exe") returned 9 [0285.279] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0285.279] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0285.279] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0285.280] lstrlenW (lpString="terminal.exe") returned 12 [0285.280] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0285.281] lstrlenW (lpString="ol_refers.exe") returned 13 [0285.281] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0285.282] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0285.282] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0285.283] lstrlenW (lpString="riding analyst.exe") returned 18 [0285.283] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0285.284] lstrlenW (lpString="robots.exe") returned 10 [0285.284] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.285] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0285.285] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0285.285] lstrlenW (lpString="expIorer32.exe") returned 14 [0285.285] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0285.286] lstrlenW (lpString="cmd.exe") returned 7 [0285.286] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0285.287] lstrlenW (lpString="conhost.exe") returned 11 [0285.287] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0285.287] lstrlenW (lpString="vssadmin.exe") returned 12 [0285.287] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0285.288] lstrlenW (lpString="VSSVC.exe") returned 9 [0285.288] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.289] lstrlenW (lpString="svchost.exe") returned 11 [0285.289] Process32NextW (in: hSnapshot=0x180, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0285.289] CloseHandle (hObject=0x180) returned 1 [0285.290] Sleep (dwMilliseconds=0x1f4) [0285.916] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fce0 [0285.952] EnumServicesStatusExW (in: hSCManager=0x35fce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0285.952] GetLastError () returned 0xea [0285.952] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x3f63888 [0285.953] EnumServicesStatusExW (in: hSCManager=0x35fce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f63888, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f63888, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0285.954] CloseServiceHandle (hSCObject=0x35fce0) returned 1 [0285.954] lstrlenW (lpString="Appinfo") returned 7 [0285.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0285.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0285.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0285.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0285.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0285.954] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0285.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0285.956] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0285.956] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0285.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0285.956] lstrlenW (lpString="AudioSrv") returned 8 [0285.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0285.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0285.956] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0285.956] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0285.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0285.956] lstrlenW (lpString="BFE") returned 3 [0285.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0285.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0285.956] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0285.956] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0285.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0285.957] lstrlenW (lpString="CryptSvc") returned 8 [0285.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0285.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0285.957] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0285.957] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0285.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0285.957] lstrlenW (lpString="CscService") returned 10 [0285.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0285.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0285.957] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0285.957] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0285.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0285.957] lstrlenW (lpString="DcomLaunch") returned 10 [0285.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0285.957] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0285.957] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0285.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0285.957] lstrlenW (lpString="Dhcp") returned 4 [0285.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0285.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0285.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0285.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0285.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0285.957] lstrlenW (lpString="Dnscache") returned 8 [0285.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0285.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0285.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0285.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0285.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0285.958] lstrlenW (lpString="DPS") returned 3 [0285.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0285.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0285.958] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0285.958] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0285.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0285.958] lstrlenW (lpString="eventlog") returned 8 [0285.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0285.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0285.958] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0285.958] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0285.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0285.958] lstrlenW (lpString="EventSystem") returned 11 [0285.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0285.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0285.958] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0285.958] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0285.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0285.958] lstrlenW (lpString="FontCache") returned 9 [0285.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0285.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0285.958] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0285.958] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0285.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0285.958] lstrlenW (lpString="gpsvc") returned 5 [0285.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0285.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0285.958] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0285.959] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0285.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0285.959] lstrlenW (lpString="iphlpsvc") returned 8 [0285.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0285.959] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0285.959] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0285.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0285.959] lstrlenW (lpString="LanmanServer") returned 12 [0285.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0285.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0285.959] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0285.959] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0285.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0285.959] lstrlenW (lpString="LanmanWorkstation") returned 17 [0285.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0285.959] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0285.959] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0285.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0285.959] lstrlenW (lpString="lmhosts") returned 7 [0285.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0285.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0285.959] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0285.959] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0285.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0285.959] lstrlenW (lpString="MMCSS") returned 5 [0285.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0285.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0285.960] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0285.960] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0285.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0285.960] lstrlenW (lpString="MpsSvc") returned 6 [0285.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0285.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0285.960] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0285.960] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0285.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0285.960] lstrlenW (lpString="Netman") returned 6 [0285.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0285.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0285.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0285.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0285.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0285.960] lstrlenW (lpString="netprofm") returned 8 [0285.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0285.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0285.960] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0285.960] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0285.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0285.960] lstrlenW (lpString="NlaSvc") returned 6 [0285.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0285.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0285.960] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0285.960] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0285.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0285.960] lstrlenW (lpString="nsi") returned 3 [0285.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0285.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0285.961] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0285.961] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0285.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0285.961] lstrlenW (lpString="PcaSvc") returned 6 [0285.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0285.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0285.961] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0285.961] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0285.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0285.961] lstrlenW (lpString="PlugPlay") returned 8 [0285.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0285.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0285.961] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0285.961] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0285.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0285.961] lstrlenW (lpString="Power") returned 5 [0285.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0285.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0285.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0285.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0285.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0285.961] lstrlenW (lpString="ProfSvc") returned 7 [0285.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0285.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0285.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0285.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0285.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0285.962] lstrlenW (lpString="RpcEptMapper") returned 12 [0285.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0285.962] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0285.962] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0285.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0285.962] lstrlenW (lpString="RpcSs") returned 5 [0285.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0285.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0285.962] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0285.962] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0285.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0285.962] lstrlenW (lpString="SamSs") returned 5 [0285.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0285.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0285.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0285.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0285.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0285.962] lstrlenW (lpString="Schedule") returned 8 [0285.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0285.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0285.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0285.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0285.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0285.962] lstrlenW (lpString="SENS") returned 4 [0285.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0285.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0285.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0285.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0285.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0285.963] lstrlenW (lpString="ShellHWDetection") returned 16 [0285.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0285.963] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0285.963] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0285.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0285.963] lstrlenW (lpString="Spooler") returned 7 [0285.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0285.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0285.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0285.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0285.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0285.963] lstrlenW (lpString="sppsvc") returned 6 [0285.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0285.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0285.963] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0285.963] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0285.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0285.963] lstrlenW (lpString="swprv") returned 5 [0285.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0285.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0285.963] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0285.963] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0285.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0285.963] lstrlenW (lpString="SysMain") returned 7 [0285.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0285.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0285.964] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0285.964] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0285.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0285.964] lstrlenW (lpString="Themes") returned 6 [0285.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0285.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0285.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0285.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0285.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0285.964] lstrlenW (lpString="TrkWks") returned 6 [0285.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0285.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0285.964] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0285.964] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0285.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0285.964] lstrlenW (lpString="UxSms") returned 5 [0285.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0285.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0285.964] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0285.964] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0285.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0285.964] lstrlenW (lpString="VSS") returned 3 [0285.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0285.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0285.964] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0285.964] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0285.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0285.964] lstrlenW (lpString="WdiServiceHost") returned 14 [0285.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0285.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0285.965] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0285.965] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0285.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0285.965] lstrlenW (lpString="WdiSystemHost") returned 13 [0285.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0285.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0285.965] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0285.965] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0285.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0285.965] lstrlenW (lpString="WinDefend") returned 9 [0285.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0285.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0285.965] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0285.965] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0285.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0285.965] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0285.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0285.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0285.965] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0285.965] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0285.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0285.965] lstrlenW (lpString="Winmgmt") returned 7 [0285.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0285.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0285.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0285.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0285.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0285.965] lstrlenW (lpString="wscsvc") returned 6 [0285.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0285.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0285.966] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0285.966] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0285.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0285.966] lstrlenW (lpString="wuauserv") returned 8 [0285.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0285.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0285.966] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0285.966] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0285.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0285.966] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f63888 | out: hHeap=0x2e0000) returned 1 [0285.966] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0285.970] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.971] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.974] lstrlenW (lpString="System") returned 6 [0285.974] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0285.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0285.974] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0285.974] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0285.974] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.983] lstrlenW (lpString="smss.exe") returned 8 [0285.984] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.984] lstrlenW (lpString="csrss.exe") returned 9 [0285.985] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.985] lstrlenW (lpString="wininit.exe") returned 11 [0285.985] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.986] lstrlenW (lpString="csrss.exe") returned 9 [0285.986] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.987] lstrlenW (lpString="winlogon.exe") returned 12 [0285.987] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.988] lstrlenW (lpString="services.exe") returned 12 [0285.988] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.989] lstrlenW (lpString="lsass.exe") returned 9 [0285.989] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0285.990] lstrlenW (lpString="lsm.exe") returned 7 [0285.990] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.991] lstrlenW (lpString="svchost.exe") returned 11 [0285.991] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.992] lstrlenW (lpString="svchost.exe") returned 11 [0285.992] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.993] lstrlenW (lpString="svchost.exe") returned 11 [0285.993] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.994] lstrlenW (lpString="svchost.exe") returned 11 [0285.994] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.995] lstrlenW (lpString="svchost.exe") returned 11 [0285.995] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.995] lstrlenW (lpString="audiodg.exe") returned 11 [0285.995] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.996] lstrlenW (lpString="svchost.exe") returned 11 [0285.996] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.997] lstrlenW (lpString="svchost.exe") returned 11 [0285.997] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0286.497] lstrlenW (lpString="dwm.exe") returned 7 [0286.497] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0286.500] lstrlenW (lpString="explorer.exe") returned 12 [0286.500] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0286.501] lstrlenW (lpString="spoolsv.exe") returned 11 [0286.501] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0286.501] lstrlenW (lpString="taskhost.exe") returned 12 [0286.501] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.502] lstrlenW (lpString="svchost.exe") returned 11 [0286.502] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0286.503] lstrlenW (lpString="taskeng.exe") returned 11 [0286.503] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.504] lstrlenW (lpString="svchost.exe") returned 11 [0286.504] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0286.504] lstrlenW (lpString="taskhost.exe") returned 12 [0286.504] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0286.505] lstrlenW (lpString="sppsvc.exe") returned 10 [0286.505] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.506] lstrlenW (lpString="svchost.exe") returned 11 [0286.506] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0286.506] lstrlenW (lpString="push nutrition.exe") returned 18 [0286.506] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0286.507] lstrlenW (lpString="procedures.exe") returned 14 [0286.507] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0286.508] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0286.508] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0286.510] lstrlenW (lpString="scanner-discover.exe") returned 20 [0286.510] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0286.511] lstrlenW (lpString="regression healthcare.exe") returned 25 [0286.511] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0286.512] lstrlenW (lpString="apr_zinc.exe") returned 12 [0286.512] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0286.513] lstrlenW (lpString="computer.exe") returned 12 [0286.513] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0286.514] lstrlenW (lpString="importanceweekend.exe") returned 21 [0286.514] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0286.514] lstrlenW (lpString="warm_absolute.exe") returned 17 [0286.514] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0286.515] lstrlenW (lpString="funding_editing.exe") returned 19 [0286.515] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0286.516] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0286.516] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0286.516] lstrlenW (lpString="friend.exe") returned 10 [0286.517] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0286.517] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0286.517] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0286.518] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0286.518] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0286.520] lstrlenW (lpString="individually_antiques.exe") returned 25 [0286.520] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0286.521] lstrlenW (lpString="embedded.exe") returned 12 [0286.521] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0286.521] lstrlenW (lpString="usually.exe") returned 11 [0286.521] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0286.522] lstrlenW (lpString="bills.exe") returned 9 [0286.522] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0286.523] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0286.523] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0286.523] lstrlenW (lpString="terminal.exe") returned 12 [0286.523] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0286.524] lstrlenW (lpString="ol_refers.exe") returned 13 [0286.524] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0286.525] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0286.525] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0286.526] lstrlenW (lpString="riding analyst.exe") returned 18 [0286.526] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0286.526] lstrlenW (lpString="robots.exe") returned 10 [0286.526] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0286.527] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0286.527] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0286.528] lstrlenW (lpString="expIorer32.exe") returned 14 [0286.528] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0286.528] lstrlenW (lpString="cmd.exe") returned 7 [0286.529] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0286.530] lstrlenW (lpString="conhost.exe") returned 11 [0286.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0286.530] lstrlenW (lpString="vssadmin.exe") returned 12 [0286.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0286.531] lstrlenW (lpString="VSSVC.exe") returned 9 [0286.531] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0286.532] lstrlenW (lpString="svchost.exe") returned 11 [0286.532] Process32NextW (in: hSnapshot=0x1c4, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0286.533] CloseHandle (hObject=0x1c4) returned 1 [0286.533] Sleep (dwMilliseconds=0x1f4) [0287.592] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35fce0 [0287.592] EnumServicesStatusExW (in: hSCManager=0x35fce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 0 [0287.592] GetLastError () returned 0xea [0287.592] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x142e) returned 0x3ef1860 [0287.592] EnumServicesStatusExW (in: hSCManager=0x35fce0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef1860, cbBufSize=0x142e, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef1860, pcbBytesNeeded=0x210ff44, lpServicesReturned=0x210ff5c, lpResumeHandle=0x0) returned 1 [0287.593] CloseServiceHandle (hSCObject=0x35fce0) returned 1 [0287.593] lstrlenW (lpString="Appinfo") returned 7 [0287.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0287.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0287.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0287.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0287.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0287.593] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0287.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0287.593] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0287.593] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0287.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0287.593] lstrlenW (lpString="AudioSrv") returned 8 [0287.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0287.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0287.593] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0287.593] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0287.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0287.593] lstrlenW (lpString="BFE") returned 3 [0287.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0287.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0287.593] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0287.593] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0287.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0287.594] lstrlenW (lpString="CryptSvc") returned 8 [0287.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0287.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0287.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0287.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0287.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0287.594] lstrlenW (lpString="CscService") returned 10 [0287.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0287.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0287.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0287.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0287.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0287.594] lstrlenW (lpString="DcomLaunch") returned 10 [0287.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0287.594] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0287.594] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0287.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0287.594] lstrlenW (lpString="Dhcp") returned 4 [0287.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0287.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0287.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0287.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0287.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0287.594] lstrlenW (lpString="Dnscache") returned 8 [0287.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0287.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0287.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0287.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0287.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0287.594] lstrlenW (lpString="DPS") returned 3 [0287.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0287.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0287.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0287.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0287.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0287.595] lstrlenW (lpString="eventlog") returned 8 [0287.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0287.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0287.595] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0287.595] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0287.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0287.595] lstrlenW (lpString="EventSystem") returned 11 [0287.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0287.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0287.595] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0287.595] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0287.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0287.595] lstrlenW (lpString="FontCache") returned 9 [0287.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0287.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0287.595] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0287.595] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0287.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0287.595] lstrlenW (lpString="gpsvc") returned 5 [0287.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0287.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0287.595] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0287.595] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0287.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0287.595] lstrlenW (lpString="iphlpsvc") returned 8 [0287.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0287.595] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0287.595] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0287.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0287.595] lstrlenW (lpString="LanmanServer") returned 12 [0287.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0287.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0287.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0287.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0287.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0287.596] lstrlenW (lpString="LanmanWorkstation") returned 17 [0287.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0287.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0287.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0287.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0287.596] lstrlenW (lpString="lmhosts") returned 7 [0287.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0287.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0287.596] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0287.596] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0287.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0287.596] lstrlenW (lpString="MMCSS") returned 5 [0287.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0287.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0287.596] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0287.596] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0287.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0287.596] lstrlenW (lpString="MpsSvc") returned 6 [0287.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0287.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0287.596] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0287.596] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0287.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0287.596] lstrlenW (lpString="Netman") returned 6 [0287.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0287.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0287.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0287.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0287.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0287.597] lstrlenW (lpString="netprofm") returned 8 [0287.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0287.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0287.597] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0287.597] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0287.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0287.597] lstrlenW (lpString="NlaSvc") returned 6 [0287.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0287.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0287.597] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0287.597] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0287.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0287.597] lstrlenW (lpString="nsi") returned 3 [0287.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0287.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0287.597] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0287.597] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0287.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0287.597] lstrlenW (lpString="PcaSvc") returned 6 [0287.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0287.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0287.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0287.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0287.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0287.597] lstrlenW (lpString="PlugPlay") returned 8 [0287.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0287.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0287.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0287.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0287.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0287.598] lstrlenW (lpString="Power") returned 5 [0287.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0287.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0287.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0287.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0287.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0287.598] lstrlenW (lpString="ProfSvc") returned 7 [0287.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0287.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0287.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0287.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0287.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0287.598] lstrlenW (lpString="RpcEptMapper") returned 12 [0287.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0287.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0287.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0287.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0287.598] lstrlenW (lpString="RpcSs") returned 5 [0287.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0287.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0287.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0287.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0287.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0287.598] lstrlenW (lpString="SamSs") returned 5 [0287.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0287.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0287.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0287.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0287.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0287.598] lstrlenW (lpString="Schedule") returned 8 [0287.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0287.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0287.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0287.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0287.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0287.599] lstrlenW (lpString="SENS") returned 4 [0287.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0287.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0287.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0287.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0287.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0287.599] lstrlenW (lpString="ShellHWDetection") returned 16 [0287.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0287.599] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0287.599] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0287.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0287.599] lstrlenW (lpString="Spooler") returned 7 [0287.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0287.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0287.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0287.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0287.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0287.599] lstrlenW (lpString="sppsvc") returned 6 [0287.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0287.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0287.599] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0287.599] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0287.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0287.599] lstrlenW (lpString="swprv") returned 5 [0287.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0287.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0287.600] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0287.600] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0287.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0287.600] lstrlenW (lpString="SysMain") returned 7 [0287.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0287.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0287.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0287.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0287.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0287.600] lstrlenW (lpString="Themes") returned 6 [0287.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0287.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0287.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0287.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0287.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0287.600] lstrlenW (lpString="TrkWks") returned 6 [0287.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0287.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0287.600] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0287.600] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0287.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0287.600] lstrlenW (lpString="UxSms") returned 5 [0287.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0287.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0287.600] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0287.600] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0287.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0287.600] lstrlenW (lpString="VSS") returned 3 [0287.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0287.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0287.600] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0287.601] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0287.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0287.601] lstrlenW (lpString="WdiServiceHost") returned 14 [0287.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0287.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0287.601] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0287.601] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0287.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0287.601] lstrlenW (lpString="WdiSystemHost") returned 13 [0287.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0287.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0287.601] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0287.601] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0287.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0287.601] lstrlenW (lpString="WinDefend") returned 9 [0287.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0287.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0287.601] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0287.601] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0287.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0287.601] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0287.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0287.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0287.601] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0287.601] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0287.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0287.601] lstrlenW (lpString="Winmgmt") returned 7 [0287.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0287.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0287.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0287.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0287.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0287.602] lstrlenW (lpString="wscsvc") returned 6 [0287.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0287.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0287.602] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0287.602] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0287.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0287.602] lstrlenW (lpString="wuauserv") returned 8 [0287.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0287.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0287.602] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0287.602] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0287.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0287.602] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ef1860 | out: hHeap=0x2e0000) returned 1 [0287.602] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0287.604] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0287.607] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0287.607] lstrlenW (lpString="System") returned 6 [0287.608] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0287.608] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0287.608] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0287.608] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0287.608] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0287.608] lstrlenW (lpString="smss.exe") returned 8 [0287.608] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.609] lstrlenW (lpString="csrss.exe") returned 9 [0287.609] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0287.610] lstrlenW (lpString="wininit.exe") returned 11 [0287.610] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0287.611] lstrlenW (lpString="csrss.exe") returned 9 [0287.611] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0287.611] lstrlenW (lpString="winlogon.exe") returned 12 [0287.611] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0287.612] lstrlenW (lpString="services.exe") returned 12 [0287.612] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0287.613] lstrlenW (lpString="lsass.exe") returned 9 [0287.613] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0287.615] lstrlenW (lpString="lsm.exe") returned 7 [0287.615] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.619] lstrlenW (lpString="svchost.exe") returned 11 [0287.619] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.620] lstrlenW (lpString="svchost.exe") returned 11 [0287.620] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.621] lstrlenW (lpString="svchost.exe") returned 11 [0287.621] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.622] lstrlenW (lpString="svchost.exe") returned 11 [0287.622] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.623] lstrlenW (lpString="svchost.exe") returned 11 [0287.623] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0287.623] lstrlenW (lpString="audiodg.exe") returned 11 [0287.623] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.624] lstrlenW (lpString="svchost.exe") returned 11 [0287.624] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.625] lstrlenW (lpString="svchost.exe") returned 11 [0287.625] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0287.625] lstrlenW (lpString="dwm.exe") returned 7 [0287.626] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0287.626] lstrlenW (lpString="explorer.exe") returned 12 [0287.626] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0287.627] lstrlenW (lpString="spoolsv.exe") returned 11 [0287.627] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0287.628] lstrlenW (lpString="taskhost.exe") returned 12 [0287.628] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.628] lstrlenW (lpString="svchost.exe") returned 11 [0287.628] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0287.629] lstrlenW (lpString="taskeng.exe") returned 11 [0287.629] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.630] lstrlenW (lpString="svchost.exe") returned 11 [0287.630] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0287.630] lstrlenW (lpString="taskhost.exe") returned 12 [0287.630] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0287.631] lstrlenW (lpString="sppsvc.exe") returned 10 [0287.631] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.632] lstrlenW (lpString="svchost.exe") returned 11 [0287.632] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="push nutrition.exe")) returned 1 [0287.632] lstrlenW (lpString="push nutrition.exe") returned 18 [0287.633] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="procedures.exe")) returned 1 [0287.633] lstrlenW (lpString="procedures.exe") returned 14 [0287.633] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="argue_cardiovascular.exe")) returned 1 [0287.634] lstrlenW (lpString="argue_cardiovascular.exe") returned 24 [0287.634] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="scanner-discover.exe")) returned 1 [0287.690] lstrlenW (lpString="scanner-discover.exe") returned 20 [0287.690] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="regression healthcare.exe")) returned 1 [0287.690] lstrlenW (lpString="regression healthcare.exe") returned 25 [0287.690] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="apr_zinc.exe")) returned 1 [0287.691] lstrlenW (lpString="apr_zinc.exe") returned 12 [0287.691] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="computer.exe")) returned 1 [0287.692] lstrlenW (lpString="computer.exe") returned 12 [0287.692] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="importanceweekend.exe")) returned 1 [0287.692] lstrlenW (lpString="importanceweekend.exe") returned 21 [0287.692] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warm_absolute.exe")) returned 1 [0287.693] lstrlenW (lpString="warm_absolute.exe") returned 17 [0287.693] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="funding_editing.exe")) returned 1 [0287.694] lstrlenW (lpString="funding_editing.exe") returned 19 [0287.694] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="incorrect-unto-offset.exe")) returned 1 [0287.695] lstrlenW (lpString="incorrect-unto-offset.exe") returned 25 [0287.695] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="friend.exe")) returned 1 [0287.695] lstrlenW (lpString="friend.exe") returned 10 [0287.695] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="empiricalchecklist.exe")) returned 1 [0287.696] lstrlenW (lpString="empiricalchecklist.exe") returned 22 [0287.696] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducted_intention_fd.exe")) returned 1 [0287.697] lstrlenW (lpString="conducted_intention_fd.exe") returned 26 [0287.697] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="individually_antiques.exe")) returned 1 [0287.698] lstrlenW (lpString="individually_antiques.exe") returned 25 [0287.698] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="embedded.exe")) returned 1 [0287.699] lstrlenW (lpString="embedded.exe") returned 12 [0287.699] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="usually.exe")) returned 1 [0287.700] lstrlenW (lpString="usually.exe") returned 11 [0287.700] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bills.exe")) returned 1 [0287.700] lstrlenW (lpString="bills.exe") returned 9 [0287.700] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cet_passes_ul.exe")) returned 1 [0287.701] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0287.701] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="terminal.exe")) returned 1 [0287.702] lstrlenW (lpString="terminal.exe") returned 12 [0287.702] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ol_refers.exe")) returned 1 [0287.703] lstrlenW (lpString="ol_refers.exe") returned 13 [0287.703] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mature-real-prostores.exe")) returned 1 [0287.703] lstrlenW (lpString="mature-real-prostores.exe") returned 25 [0287.703] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="riding analyst.exe")) returned 1 [0287.704] lstrlenW (lpString="riding analyst.exe") returned 18 [0287.704] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="robots.exe")) returned 1 [0287.705] lstrlenW (lpString="robots.exe") returned 10 [0287.705] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0287.705] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0287.705] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="expIorer32.exe")) returned 1 [0287.706] lstrlenW (lpString="expIorer32.exe") returned 14 [0287.706] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x86c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0287.707] lstrlenW (lpString="cmd.exe") returned 7 [0287.707] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0287.707] lstrlenW (lpString="conhost.exe") returned 11 [0287.707] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x89c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0287.708] lstrlenW (lpString="vssadmin.exe") returned 12 [0287.708] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0287.709] lstrlenW (lpString="VSSVC.exe") returned 9 [0287.709] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0287.709] lstrlenW (lpString="svchost.exe") returned 11 [0287.709] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0287.710] lstrlenW (lpString="LogonUI.exe") returned 11 [0287.710] Process32NextW (in: hSnapshot=0x1c8, lppe=0x210fd34 | out: lppe=0x210fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0287.711] CloseHandle (hObject=0x1c8) returned 1 [0287.711] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x8cc [0258.547] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0258.547] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x314a48 | out: hHeap=0x2e0000) returned 1 Thread: id = 6 os_tid = 0x114 [0258.548] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x314a48 [0258.548] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x314a48, Size=0x20) returned 0x315cb8 [0258.548] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x315cb8, Size=0x40) returned 0x316c48 [0258.548] GetLogicalDrives () returned 0x4 [0258.548] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x34e618 [0258.548] GetComputerNameW (in: lpBuffer=0x34e61c, nSize=0x238ff6c | out: lpBuffer="XDUWTFONO", nSize=0x238ff6c) returned 1 [0258.549] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x35e620 [0258.549] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x238ff3c | out: lphEnum=0x238ff3c*=0x3161b8) returned 0x0 [0258.549] WNetEnumResourceW (in: hEnum=0x3161b8, lpcCount=0x238ff38, lpBuffer=0x35e620, lpBufferSize=0x238ff40 | out: lpcCount=0x238ff38, lpBuffer=0x35e620, lpBufferSize=0x238ff40) returned 0x103 [0258.549] WNetCloseEnum (hEnum=0x3161b8) returned 0x0 [0258.549] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x238ff3c | out: lphEnum=0x238ff3c*=0x3f02a08) returned 0x0 [0263.644] WNetEnumResourceW (in: hEnum=0x3f02a08, lpcCount=0x238ff38, lpBuffer=0x35e620, lpBufferSize=0x238ff40 | out: lpcCount=0x238ff38, lpBuffer=0x35e620, lpBufferSize=0x238ff40) returned 0x0 [0263.645] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x3391f8 [0263.645] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x35e620, lphEnum=0x238ff10 | out: lphEnum=0x238ff10*=0x316338) returned 0x0 [0263.877] WNetEnumResourceW (in: hEnum=0x316338, lpcCount=0x238ff0c, lpBuffer=0x3391f8, lpBufferSize=0x238ff14 | out: lpcCount=0x238ff0c, lpBuffer=0x3391f8, lpBufferSize=0x238ff14) returned 0x103 [0263.877] WNetCloseEnum (hEnum=0x316338) returned 0x0 [0263.877] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x397a740 [0263.877] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x35e640, lphEnum=0x238ff10 | out: lphEnum=0x238ff10*=0x0) returned 0x4b8 [0284.920] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x1000) returned 0x3fa9910 [0284.921] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x35e660, lphEnum=0x238ff10 | out: lphEnum=0x238ff10*=0x0) returned 0x4c6 [0284.970] WNetEnumResourceW (in: hEnum=0x3f02a08, lpcCount=0x238ff38, lpBuffer=0x35e620, lpBufferSize=0x238ff40 | out: lpcCount=0x238ff38, lpBuffer=0x35e620, lpBufferSize=0x238ff40) returned 0x103 [0284.970] WNetCloseEnum (hEnum=0x3f02a08) returned 0x0 [0284.970] GetLogicalDrives () returned 0x4 [0284.970] Sleep (dwMilliseconds=0x64) [0285.154] GetLogicalDrives () returned 0x4 [0285.154] Sleep (dwMilliseconds=0x64) [0285.290] GetLogicalDrives () returned 0x4 [0285.290] Sleep (dwMilliseconds=0x64) [0285.446] GetLogicalDrives () returned 0x4 [0285.446] Sleep (dwMilliseconds=0x64) [0285.546] GetLogicalDrives () returned 0x4 [0285.546] Sleep (dwMilliseconds=0x64) [0285.656] GetLogicalDrives () returned 0x4 [0285.656] Sleep (dwMilliseconds=0x64) [0285.807] GetLogicalDrives () returned 0x4 [0285.807] Sleep (dwMilliseconds=0x64) [0286.058] GetLogicalDrives () returned 0x4 [0286.058] Sleep (dwMilliseconds=0x64) [0286.549] GetLogicalDrives () returned 0x4 [0286.549] Sleep (dwMilliseconds=0x64) [0286.710] GetLogicalDrives () returned 0x4 [0286.710] Sleep (dwMilliseconds=0x64) [0286.823] GetLogicalDrives () returned 0x4 [0286.823] Sleep (dwMilliseconds=0x64) [0287.591] GetLogicalDrives () returned 0x4 [0287.591] Sleep (dwMilliseconds=0x64) [0287.734] GetLogicalDrives () returned 0x4 [0287.734] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x598 [0260.299] GetTickCount () returned 0x3730d [0260.299] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x33b560 [0260.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x33b560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0260.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x33b560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0260.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x33b560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0260.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x33b560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0260.305] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3303f0 [0260.305] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3303f0, Size=0x20) returned 0x35fa60 [0260.305] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3303f0 [0260.305] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3303f0, Size=0x20) returned 0x35fa88 [0260.306] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.306] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.306] Wow64DisableWow64FsRedirection (in: OldValue=0x24cff84 | out: OldValue=0x24cff84*=0x0) returned 1 [0260.306] lstrlenW (lpString="kernel32.dll") returned 12 [0260.306] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fa60 | out: hHeap=0x2e0000) returned 1 [0260.306] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.306] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fa88 | out: hHeap=0x2e0000) returned 1 [0260.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x31b5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0260.308] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0260.762] GetTickCount () returned 0x37389 [0260.762] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0261.292] GetTickCount () returned 0x37425 [0261.292] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0261.599] GetTickCount () returned 0x374f0 [0261.599] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0261.875] GetTickCount () returned 0x37609 [0261.875] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0262.018] GetTickCount () returned 0x37695 [0262.018] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0262.180] GetTickCount () returned 0x37741 [0262.180] GetTickCount () returned 0x37741 [0262.180] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0262.601] GetTickCount () returned 0x37879 [0262.601] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0263.066] GetTickCount () returned 0x37a0f [0263.066] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0263.270] GetTickCount () returned 0x37ad9 [0263.270] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0263.534] GetTickCount () returned 0x37be3 [0263.534] GetTickCount () returned 0x37be3 [0263.534] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0263.800] GetTickCount () returned 0x37cec [0263.800] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0264.351] GetTickCount () returned 0x37edf [0264.351] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0264.848] GetTickCount () returned 0x37ff8 [0264.848] GetTickCount () returned 0x37ff8 [0264.848] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0265.031] GetTickCount () returned 0x380a3 [0265.031] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0265.298] GetTickCount () returned 0x381bc [0265.298] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0266.476] GetTickCount () returned 0x38352 [0266.476] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0267.031] GetTickCount () returned 0x38526 [0267.031] GetTickCount () returned 0x38526 [0267.031] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0267.617] GetTickCount () returned 0x38738 [0267.617] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0267.922] GetTickCount () returned 0x38870 [0267.922] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0268.027] GetTickCount () returned 0x388dd [0268.027] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0268.288] GetTickCount () returned 0x389d7 [0268.288] GetTickCount () returned 0x389d7 [0268.288] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0268.686] GetTickCount () returned 0x38b5d [0268.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0269.185] GetTickCount () returned 0x38ce3 [0269.185] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0269.561] GetTickCount () returned 0x38e2b [0269.561] GetTickCount () returned 0x38e2b [0269.561] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0269.919] GetTickCount () returned 0x38f91 [0269.919] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0270.324] GetTickCount () returned 0x39108 [0270.324] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0270.617] GetTickCount () returned 0x39230 [0270.617] GetTickCount () returned 0x39230 [0270.617] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0270.855] GetTickCount () returned 0x392fb [0270.855] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0271.269] GetTickCount () returned 0x39491 [0271.269] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0271.609] GetTickCount () returned 0x395b9 [0271.609] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0271.843] GetTickCount () returned 0x39693 [0271.843] GetTickCount () returned 0x39693 [0271.843] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0271.944] GetTickCount () returned 0x39701 [0271.944] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.054] GetTickCount () returned 0x3976e [0272.054] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.161] GetTickCount () returned 0x397db [0272.161] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.270] GetTickCount () returned 0x39848 [0272.270] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.475] GetTickCount () returned 0x39913 [0272.475] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.582] GetTickCount () returned 0x39980 [0272.582] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.692] GetTickCount () returned 0x399ed [0272.692] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.801] GetTickCount () returned 0x39a5b [0272.801] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0272.910] GetTickCount () returned 0x39ac8 [0272.910] GetTickCount () returned 0x39ac8 [0272.910] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.028] GetTickCount () returned 0x39b35 [0273.028] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.128] GetTickCount () returned 0x39ba2 [0273.128] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.237] GetTickCount () returned 0x39c0f [0273.237] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.351] GetTickCount () returned 0x39c7d [0273.351] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.456] GetTickCount () returned 0x39cea [0273.456] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.565] GetTickCount () returned 0x39d57 [0273.565] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.681] GetTickCount () returned 0x39dc4 [0273.681] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.784] GetTickCount () returned 0x39e31 [0273.784] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0273.903] GetTickCount () returned 0x39e9f [0273.903] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.002] GetTickCount () returned 0x39f0c [0274.002] GetTickCount () returned 0x39f0c [0274.002] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.111] GetTickCount () returned 0x39f79 [0274.111] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.220] GetTickCount () returned 0x39fe6 [0274.220] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.334] GetTickCount () returned 0x3a053 [0274.334] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.441] GetTickCount () returned 0x3a0c1 [0274.441] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.548] GetTickCount () returned 0x3a12e [0274.548] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.657] GetTickCount () returned 0x3a19b [0274.657] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.797] GetTickCount () returned 0x3a227 [0274.797] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0274.908] GetTickCount () returned 0x3a295 [0274.908] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.016] GetTickCount () returned 0x3a302 [0275.016] GetTickCount () returned 0x3a302 [0275.016] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.125] GetTickCount () returned 0x3a36f [0275.125] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.234] GetTickCount () returned 0x3a3dc [0275.234] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.390] GetTickCount () returned 0x3a478 [0275.390] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.500] GetTickCount () returned 0x3a4e5 [0275.500] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.609] GetTickCount () returned 0x3a553 [0275.609] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.734] GetTickCount () returned 0x3a5cf [0275.734] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.845] GetTickCount () returned 0x3a63d [0275.845] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0275.983] GetTickCount () returned 0x3a6c9 [0275.983] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.120] GetTickCount () returned 0x3a746 [0276.120] GetTickCount () returned 0x3a746 [0276.120] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.217] GetTickCount () returned 0x3a7b3 [0276.218] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.326] GetTickCount () returned 0x3a820 [0276.327] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.436] GetTickCount () returned 0x3a88d [0276.436] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.545] GetTickCount () returned 0x3a8fb [0276.545] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.732] GetTickCount () returned 0x3a968 [0276.732] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.841] GetTickCount () returned 0x3a9d5 [0276.841] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0276.951] GetTickCount () returned 0x3aa42 [0276.951] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.060] GetTickCount () returned 0x3aaaf [0277.060] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.169] GetTickCount () returned 0x3ab1d [0277.169] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.281] GetTickCount () returned 0x3ab8a [0277.281] GetTickCount () returned 0x3ab8a [0277.281] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.387] GetTickCount () returned 0x3abf7 [0277.387] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.496] GetTickCount () returned 0x3ac64 [0277.497] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.606] GetTickCount () returned 0x3acd1 [0277.606] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.715] GetTickCount () returned 0x3ad3f [0277.715] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0277.854] GetTickCount () returned 0x3adbb [0277.854] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0278.012] GetTickCount () returned 0x3ae67 [0278.012] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0278.207] GetTickCount () returned 0x3af22 [0278.207] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0278.327] GetTickCount () returned 0x3af9f [0278.327] GetTickCount () returned 0x3af9f [0278.327] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0278.645] GetTickCount () returned 0x3b0d7 [0278.645] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0278.872] GetTickCount () returned 0x3b1c1 [0278.872] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0279.294] GetTickCount () returned 0x3b366 [0279.294] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0279.588] GetTickCount () returned 0x3b48f [0279.588] GetTickCount () returned 0x3b48f [0279.588] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0279.731] GetTickCount () returned 0x3b51b [0279.731] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0280.395] GetTickCount () returned 0x3b624 [0280.395] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0281.500] GetTickCount () returned 0x3b71e [0281.500] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0281.916] GetTickCount () returned 0x3b827 [0281.917] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0282.231] GetTickCount () returned 0x3b95f [0282.231] GetTickCount () returned 0x3b95f [0282.232] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0282.498] GetTickCount () returned 0x3ba68 [0282.498] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0282.737] GetTickCount () returned 0x3bb52 [0282.737] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0282.869] GetTickCount () returned 0x3bbdf [0282.869] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0283.119] GetTickCount () returned 0x3bcd8 [0283.119] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0283.301] GetTickCount () returned 0x3bd93 [0283.301] GetTickCount () returned 0x3bd93 [0283.301] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0283.546] GetTickCount () returned 0x3be7d [0283.546] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0283.683] GetTickCount () returned 0x3bf0a [0283.683] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0283.911] GetTickCount () returned 0x3bff4 [0283.911] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0284.254] GetTickCount () returned 0x3c14b [0284.254] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0284.482] GetTickCount () returned 0x3c225 [0284.482] GetTickCount () returned 0x3c225 [0284.482] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0284.638] GetTickCount () returned 0x3c2c1 [0284.638] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0284.847] GetTickCount () returned 0x3c39c [0284.847] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0285.057] GetTickCount () returned 0x3c467 [0285.057] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0285.249] GetTickCount () returned 0x3c531 [0285.250] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0285.419] GetTickCount () returned 0x3c5ae [0285.419] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0285.542] GetTickCount () returned 0x3c62b [0285.543] GetTickCount () returned 0x3c62b [0285.543] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0285.640] GetTickCount () returned 0x3c698 [0285.640] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0285.807] GetTickCount () returned 0x3c734 [0285.807] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0286.058] GetTickCount () returned 0x3c82e [0286.058] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0286.549] GetTickCount () returned 0x3ca21 [0286.549] GetTickCount () returned 0x3ca21 [0286.549] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0286.710] GetTickCount () returned 0x3cabd [0286.710] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0286.823] GetTickCount () returned 0x3cb2a [0286.823] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0287.591] GetTickCount () returned 0x3ce36 [0287.591] GetTickCount () returned 0x3ce36 [0287.591] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0287.734] GetTickCount () returned 0x3cec3 [0287.734] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x5a4 [0260.300] GetTickCount () returned 0x3730d [0260.300] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x24) returned 0x32bf90 [0260.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0260.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0260.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0260.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x32bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0260.307] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3303f0 [0260.307] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3303f0, Size=0x20) returned 0x35fa60 [0260.307] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3303f0 [0260.307] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3303f0, Size=0x20) returned 0x35fa88 [0260.307] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.307] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.307] Wow64DisableWow64FsRedirection (in: OldValue=0x260ff84 | out: OldValue=0x260ff84*=0x0) returned 1 [0260.307] lstrlenW (lpString="kernel32.dll") returned 12 [0260.307] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fa60 | out: hHeap=0x2e0000) returned 1 [0260.308] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.308] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fa88 | out: hHeap=0x2e0000) returned 1 [0260.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x33d5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0260.308] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0260.762] GetTickCount () returned 0x37389 [0260.762] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0261.292] GetTickCount () returned 0x37425 [0261.292] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0261.600] GetTickCount () returned 0x374f0 [0261.600] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0261.875] GetTickCount () returned 0x37609 [0261.875] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0262.018] GetTickCount () returned 0x37695 [0262.018] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0262.180] GetTickCount () returned 0x37741 [0262.180] GetTickCount () returned 0x37741 [0262.180] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0262.601] GetTickCount () returned 0x37879 [0262.601] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0263.066] GetTickCount () returned 0x37a0f [0263.066] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0263.270] GetTickCount () returned 0x37ad9 [0263.270] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0263.534] GetTickCount () returned 0x37be3 [0263.534] GetTickCount () returned 0x37be3 [0263.534] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0263.800] GetTickCount () returned 0x37cec [0263.800] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0264.351] GetTickCount () returned 0x37edf [0264.351] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0264.848] GetTickCount () returned 0x37ff8 [0264.848] GetTickCount () returned 0x37ff8 [0264.848] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0265.031] GetTickCount () returned 0x380a3 [0265.031] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0265.298] GetTickCount () returned 0x381bc [0265.298] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0266.476] GetTickCount () returned 0x38352 [0266.476] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0267.031] GetTickCount () returned 0x38526 [0267.031] GetTickCount () returned 0x38526 [0267.031] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0267.617] GetTickCount () returned 0x38738 [0267.617] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0267.922] GetTickCount () returned 0x38870 [0267.922] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0268.027] GetTickCount () returned 0x388dd [0268.027] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0268.288] GetTickCount () returned 0x389d7 [0268.288] GetTickCount () returned 0x389d7 [0268.288] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0268.686] GetTickCount () returned 0x38b5d [0268.686] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0269.184] GetTickCount () returned 0x38ce3 [0269.184] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0269.561] GetTickCount () returned 0x38e2b [0269.561] GetTickCount () returned 0x38e2b [0269.561] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0269.919] GetTickCount () returned 0x38f91 [0269.919] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0270.324] GetTickCount () returned 0x39108 [0270.324] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0270.618] GetTickCount () returned 0x39230 [0270.618] GetTickCount () returned 0x39230 [0270.618] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0270.855] GetTickCount () returned 0x392fb [0270.855] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0271.269] GetTickCount () returned 0x39491 [0271.269] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0271.609] GetTickCount () returned 0x395b9 [0271.609] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0271.843] GetTickCount () returned 0x39693 [0271.843] GetTickCount () returned 0x39693 [0271.843] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0271.944] GetTickCount () returned 0x39701 [0271.944] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.054] GetTickCount () returned 0x3976e [0272.054] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.161] GetTickCount () returned 0x397db [0272.161] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.270] GetTickCount () returned 0x39848 [0272.270] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.475] GetTickCount () returned 0x39913 [0272.475] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.582] GetTickCount () returned 0x39980 [0272.582] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.692] GetTickCount () returned 0x399ed [0272.692] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.801] GetTickCount () returned 0x39a5b [0272.801] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0272.910] GetTickCount () returned 0x39ac8 [0272.910] GetTickCount () returned 0x39ac8 [0272.910] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.028] GetTickCount () returned 0x39b35 [0273.028] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.128] GetTickCount () returned 0x39ba2 [0273.128] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.238] GetTickCount () returned 0x39c0f [0273.238] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.351] GetTickCount () returned 0x39c7d [0273.351] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.456] GetTickCount () returned 0x39cea [0273.456] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.565] GetTickCount () returned 0x39d57 [0273.565] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.681] GetTickCount () returned 0x39dc4 [0273.681] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.784] GetTickCount () returned 0x39e31 [0273.784] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0273.903] GetTickCount () returned 0x39e9f [0273.903] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.002] GetTickCount () returned 0x39f0c [0274.002] GetTickCount () returned 0x39f0c [0274.002] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.111] GetTickCount () returned 0x39f79 [0274.111] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.221] GetTickCount () returned 0x39fe6 [0274.221] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.334] GetTickCount () returned 0x3a053 [0274.334] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.441] GetTickCount () returned 0x3a0c1 [0274.441] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.548] GetTickCount () returned 0x3a12e [0274.548] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.657] GetTickCount () returned 0x3a19b [0274.657] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.798] GetTickCount () returned 0x3a227 [0274.798] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0274.908] GetTickCount () returned 0x3a295 [0274.908] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.016] GetTickCount () returned 0x3a302 [0275.016] GetTickCount () returned 0x3a302 [0275.016] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.125] GetTickCount () returned 0x3a36f [0275.125] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.234] GetTickCount () returned 0x3a3dc [0275.234] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.390] GetTickCount () returned 0x3a478 [0275.390] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.500] GetTickCount () returned 0x3a4e5 [0275.500] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.609] GetTickCount () returned 0x3a553 [0275.609] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.734] GetTickCount () returned 0x3a5cf [0275.734] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.845] GetTickCount () returned 0x3a63d [0275.845] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0275.983] GetTickCount () returned 0x3a6c9 [0275.983] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.097] GetTickCount () returned 0x3a736 [0276.097] GetTickCount () returned 0x3a746 [0276.120] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.218] GetTickCount () returned 0x3a7b3 [0276.218] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.327] GetTickCount () returned 0x3a820 [0276.327] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.436] GetTickCount () returned 0x3a88d [0276.436] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.546] GetTickCount () returned 0x3a8fb [0276.546] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.732] GetTickCount () returned 0x3a968 [0276.732] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.841] GetTickCount () returned 0x3a9d5 [0276.841] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0276.951] GetTickCount () returned 0x3aa42 [0276.951] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.060] GetTickCount () returned 0x3aaaf [0277.060] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.169] GetTickCount () returned 0x3ab1d [0277.169] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.281] GetTickCount () returned 0x3ab8a [0277.281] GetTickCount () returned 0x3ab8a [0277.281] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.387] GetTickCount () returned 0x3abf7 [0277.387] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.497] GetTickCount () returned 0x3ac64 [0277.497] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.606] GetTickCount () returned 0x3acd1 [0277.606] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.715] GetTickCount () returned 0x3ad3f [0277.715] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0277.854] GetTickCount () returned 0x3adbb [0277.854] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0278.012] GetTickCount () returned 0x3ae67 [0278.012] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0278.208] GetTickCount () returned 0x3af22 [0278.208] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0278.327] GetTickCount () returned 0x3af9f [0278.327] GetTickCount () returned 0x3af9f [0278.327] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0278.644] GetTickCount () returned 0x3b0d7 [0278.645] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0278.872] GetTickCount () returned 0x3b1c1 [0278.872] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0279.294] GetTickCount () returned 0x3b366 [0279.294] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0279.588] GetTickCount () returned 0x3b48f [0279.588] GetTickCount () returned 0x3b48f [0279.588] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0279.731] GetTickCount () returned 0x3b51b [0279.731] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0280.395] GetTickCount () returned 0x3b624 [0280.395] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0281.500] GetTickCount () returned 0x3b71e [0281.500] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0281.916] GetTickCount () returned 0x3b827 [0281.916] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0282.231] GetTickCount () returned 0x3b95f [0282.231] GetTickCount () returned 0x3b95f [0282.231] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0282.498] GetTickCount () returned 0x3ba68 [0282.498] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0282.737] GetTickCount () returned 0x3bb52 [0282.737] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0282.869] GetTickCount () returned 0x3bbdf [0282.869] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0283.119] GetTickCount () returned 0x3bcd8 [0283.119] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0283.301] GetTickCount () returned 0x3bd93 [0283.301] GetTickCount () returned 0x3bd93 [0283.302] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0283.546] GetTickCount () returned 0x3be7d [0283.546] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0283.683] GetTickCount () returned 0x3bf0a [0283.683] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0283.911] GetTickCount () returned 0x3bff4 [0283.911] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0284.254] GetTickCount () returned 0x3c14b [0284.254] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0284.482] GetTickCount () returned 0x3c225 [0284.482] GetTickCount () returned 0x3c225 [0284.482] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0284.638] GetTickCount () returned 0x3c2c1 [0284.638] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0284.847] GetTickCount () returned 0x3c39c [0284.847] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0285.057] GetTickCount () returned 0x3c467 [0285.057] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0285.250] GetTickCount () returned 0x3c531 [0285.250] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0285.419] GetTickCount () returned 0x3c5ae [0285.420] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0285.543] GetTickCount () returned 0x3c62b [0285.543] GetTickCount () returned 0x3c62b [0285.543] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0285.640] GetTickCount () returned 0x3c698 [0285.640] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0285.807] GetTickCount () returned 0x3c734 [0285.807] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0286.058] GetTickCount () returned 0x3c82e [0286.058] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0286.548] GetTickCount () returned 0x3ca21 [0286.548] GetTickCount () returned 0x3ca21 [0286.549] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0286.710] GetTickCount () returned 0x3cabd [0286.710] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0286.823] GetTickCount () returned 0x3cb2a [0286.823] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0287.591] GetTickCount () returned 0x3ce36 [0287.591] GetTickCount () returned 0x3ce36 [0287.591] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0287.734] GetTickCount () returned 0x3cec3 [0287.734] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x3c4 [0260.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x360458 [0260.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x370460 [0260.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330450 [0260.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a380 [0260.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330468 [0260.778] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3550020 [0260.779] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330480 [0260.779] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330480, Size=0x20) returned 0x35fad8 [0260.779] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330480 [0260.779] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330480, Size=0x20) returned 0x35fb00 [0260.779] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.779] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.779] Wow64DisableWow64FsRedirection (in: OldValue=0x224ff58 | out: OldValue=0x224ff58*=0x0) returned 1 [0260.779] lstrlenW (lpString="kernel32.dll") returned 12 [0260.779] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.779] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.779] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.779] Sleep (dwMilliseconds=0x64) [0261.294] lstrcmpiW (lpString1=".LOG", lpString2=".drweb") returned 1 [0261.294] lstrlenW (lpString="BCD.LOG") returned 7 [0261.294] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.398] lstrlenW (lpString=".doc") returned 4 [0261.398] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0261.398] lstrlenW (lpString=".docx") returned 5 [0261.398] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0261.398] lstrlenW (lpString=".pdf") returned 4 [0261.398] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0261.398] lstrlenW (lpString=".xls") returned 4 [0261.398] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0261.398] lstrlenW (lpString=".xlsx") returned 5 [0261.398] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0261.398] lstrlenW (lpString=".ppt") returned 4 [0261.398] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0261.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.398] lstrlenW (lpString=".zip") returned 4 [0261.398] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0261.398] lstrlenW (lpString=".rar") returned 4 [0261.398] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0261.398] lstrlenW (lpString=".bz2") returned 4 [0261.398] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0261.398] lstrlenW (lpString=".7z") returned 3 [0261.398] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0261.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.398] lstrlenW (lpString=".dbf") returned 4 [0261.398] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0261.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.399] lstrlenW (lpString=".1cd") returned 4 [0261.399] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0261.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.399] lstrlenW (lpString=".jpg") returned 4 [0261.399] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0261.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.399] lstrlenW (lpString=".doc") returned 4 [0261.399] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0261.399] lstrlenW (lpString=".docx") returned 5 [0261.399] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0261.399] lstrlenW (lpString=".pdf") returned 4 [0261.399] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0261.399] lstrlenW (lpString=".xls") returned 4 [0261.399] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0261.399] lstrlenW (lpString=".xlsx") returned 5 [0261.399] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0261.399] lstrlenW (lpString=".ppt") returned 4 [0261.399] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0261.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.399] lstrlenW (lpString=".zip") returned 4 [0261.399] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0261.399] lstrlenW (lpString=".rar") returned 4 [0261.399] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0261.399] lstrlenW (lpString=".bz2") returned 4 [0261.399] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0261.399] lstrlenW (lpString=".7z") returned 3 [0261.400] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0261.400] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.400] lstrlenW (lpString=".dbf") returned 4 [0261.400] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0261.400] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.400] lstrlenW (lpString=".1cd") returned 4 [0261.400] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0261.400] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0261.400] lstrlenW (lpString=".jpg") returned 4 [0261.400] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0261.400] Sleep (dwMilliseconds=0x64) [0261.770] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.770] lstrlenW (lpString="Setup.xml") returned 9 [0261.770] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.377] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1886) returned 1 [0262.377] CloseHandle (hObject=0x170) returned 1 [0262.377] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0262.377] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.377] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.377] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.377] GetLastError () returned 0x0 [0262.377] ReadFile (in: hFile=0x170, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x75e, lpOverlapped=0x0) returned 1 [0262.618] WriteFile (in: hFile=0x190, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x760, lpOverlapped=0x0) returned 1 [0262.619] ReadFile (in: hFile=0x170, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.619] WriteFile (in: hFile=0x190, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.619] SetEndOfFile (hFile=0x190) returned 1 [0262.619] CloseHandle (hObject=0x190) returned 1 [0262.620] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.620] SetEndOfFile (hFile=0x170) returned 1 [0262.621] CloseHandle (hObject=0x170) returned 1 [0262.621] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.621] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0262.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.621] lstrlenW (lpString=".doc") returned 4 [0262.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.621] lstrlenW (lpString=".docx") returned 5 [0262.621] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.621] lstrlenW (lpString=".pdf") returned 4 [0262.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString=".xls") returned 4 [0262.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString=".xlsx") returned 5 [0262.622] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.622] lstrlenW (lpString=".ppt") returned 4 [0262.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.622] lstrlenW (lpString=".zip") returned 4 [0262.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.622] lstrlenW (lpString=".rar") returned 4 [0262.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString=".bz2") returned 4 [0262.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString=".7z") returned 3 [0262.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.622] lstrlenW (lpString=".dbf") returned 4 [0262.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.622] lstrlenW (lpString=".1cd") returned 4 [0262.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.622] lstrlenW (lpString=".jpg") returned 4 [0262.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.622] lstrlenW (lpString=".doc") returned 4 [0262.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString=".docx") returned 5 [0262.622] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.622] lstrlenW (lpString=".pdf") returned 4 [0262.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.622] lstrlenW (lpString=".xls") returned 4 [0262.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.623] lstrlenW (lpString=".xlsx") returned 5 [0262.623] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.623] lstrlenW (lpString=".ppt") returned 4 [0262.623] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.623] lstrlenW (lpString=".zip") returned 4 [0262.623] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.623] lstrlenW (lpString=".rar") returned 4 [0262.623] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.623] lstrlenW (lpString=".bz2") returned 4 [0262.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.623] lstrlenW (lpString=".7z") returned 3 [0262.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.623] lstrlenW (lpString=".dbf") returned 4 [0262.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.623] lstrlenW (lpString=".1cd") returned 4 [0262.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.623] lstrlenW (lpString=".jpg") returned 4 [0262.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.623] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.623] lstrlenW (lpString="Setup.xml") returned 9 [0262.623] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.624] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1852) returned 1 [0262.624] CloseHandle (hObject=0x170) returned 1 [0262.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0262.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.624] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.624] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.624] GetLastError () returned 0x0 [0262.624] ReadFile (in: hFile=0x170, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x73c, lpOverlapped=0x0) returned 1 [0262.640] WriteFile (in: hFile=0x190, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x740, lpOverlapped=0x0) returned 1 [0262.641] ReadFile (in: hFile=0x170, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.641] WriteFile (in: hFile=0x190, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.641] SetEndOfFile (hFile=0x190) returned 1 [0262.641] CloseHandle (hObject=0x190) returned 1 [0262.652] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.652] SetEndOfFile (hFile=0x170) returned 1 [0262.653] CloseHandle (hObject=0x170) returned 1 [0262.653] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.653] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0262.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.653] lstrlenW (lpString=".doc") returned 4 [0262.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString=".docx") returned 5 [0262.654] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.654] lstrlenW (lpString=".pdf") returned 4 [0262.654] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString=".xls") returned 4 [0262.654] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString=".xlsx") returned 5 [0262.654] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.654] lstrlenW (lpString=".ppt") returned 4 [0262.654] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.654] lstrlenW (lpString=".zip") returned 4 [0262.654] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.654] lstrlenW (lpString=".rar") returned 4 [0262.654] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString=".bz2") returned 4 [0262.654] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString=".7z") returned 3 [0262.654] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.654] lstrlenW (lpString=".dbf") returned 4 [0262.654] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.654] lstrlenW (lpString=".1cd") returned 4 [0262.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.654] lstrlenW (lpString=".jpg") returned 4 [0262.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.655] lstrlenW (lpString=".doc") returned 4 [0262.655] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString=".docx") returned 5 [0262.655] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.655] lstrlenW (lpString=".pdf") returned 4 [0262.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString=".xls") returned 4 [0262.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString=".xlsx") returned 5 [0262.655] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.655] lstrlenW (lpString=".ppt") returned 4 [0262.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.655] lstrlenW (lpString=".zip") returned 4 [0262.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.655] lstrlenW (lpString=".rar") returned 4 [0262.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString=".bz2") returned 4 [0262.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString=".7z") returned 3 [0262.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.655] lstrlenW (lpString=".dbf") returned 4 [0262.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.655] lstrlenW (lpString=".1cd") returned 4 [0262.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.655] lstrlenW (lpString=".jpg") returned 4 [0262.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.656] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.656] lstrlenW (lpString="VisioMUI.xml") returned 12 [0262.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0262.991] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=9503) returned 1 [0262.992] CloseHandle (hObject=0x19c) returned 1 [0262.992] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0262.992] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.992] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0262.992] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.992] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.992] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0263.086] GetLastError () returned 0x0 [0263.086] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x251f, lpOverlapped=0x0) returned 1 [0263.395] WriteFile (in: hFile=0x16c, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0263.396] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.396] WriteFile (in: hFile=0x16c, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.396] SetEndOfFile (hFile=0x16c) returned 1 [0263.396] CloseHandle (hObject=0x16c) returned 1 [0263.398] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.398] SetEndOfFile (hFile=0x19c) returned 1 [0263.399] CloseHandle (hObject=0x19c) returned 1 [0263.399] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.399] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0263.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.399] lstrlenW (lpString=".doc") returned 4 [0263.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.399] lstrlenW (lpString=".docx") returned 5 [0263.399] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.399] lstrlenW (lpString=".pdf") returned 4 [0263.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.399] lstrlenW (lpString=".xls") returned 4 [0263.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.399] lstrlenW (lpString=".xlsx") returned 5 [0263.399] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.399] lstrlenW (lpString=".ppt") returned 4 [0263.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString=".zip") returned 4 [0263.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.400] lstrlenW (lpString=".rar") returned 4 [0263.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString=".bz2") returned 4 [0263.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString=".7z") returned 3 [0263.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString=".dbf") returned 4 [0263.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString=".1cd") returned 4 [0263.400] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString=".jpg") returned 4 [0263.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString=".doc") returned 4 [0263.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString=".docx") returned 5 [0263.400] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.400] lstrlenW (lpString=".pdf") returned 4 [0263.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString=".xls") returned 4 [0263.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString=".xlsx") returned 5 [0263.400] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.400] lstrlenW (lpString=".ppt") returned 4 [0263.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.400] lstrlenW (lpString=".zip") returned 4 [0263.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.400] lstrlenW (lpString=".rar") returned 4 [0263.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.400] lstrlenW (lpString=".bz2") returned 4 [0263.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.401] lstrlenW (lpString=".7z") returned 3 [0263.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.401] lstrlenW (lpString=".dbf") returned 4 [0263.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.401] lstrlenW (lpString=".1cd") returned 4 [0263.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0263.401] lstrlenW (lpString=".jpg") returned 4 [0263.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.401] lstrcmpiW (lpString1=".chm", lpString2=".drweb") returned -1 [0263.401] lstrlenW (lpString="pss10r.chm") returned 10 [0263.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0263.419] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=27195) returned 1 [0263.419] CloseHandle (hObject=0x184) returned 1 [0263.419] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0263.419] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0263.420] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.420] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.420] GetLastError () returned 0x0 [0263.420] ReadFile (in: hFile=0x184, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0263.449] WriteFile (in: hFile=0x188, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0263.450] ReadFile (in: hFile=0x184, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.450] WriteFile (in: hFile=0x188, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0263.450] SetEndOfFile (hFile=0x188) returned 1 [0263.450] CloseHandle (hObject=0x188) returned 1 [0263.452] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.452] SetEndOfFile (hFile=0x184) returned 1 [0263.452] CloseHandle (hObject=0x184) returned 1 [0263.452] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.453] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0263.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.453] lstrlenW (lpString=".doc") returned 4 [0263.453] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0263.453] lstrlenW (lpString=".docx") returned 5 [0263.453] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0263.453] lstrlenW (lpString=".pdf") returned 4 [0263.453] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0263.453] lstrlenW (lpString=".xls") returned 4 [0263.453] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0263.453] lstrlenW (lpString=".xlsx") returned 5 [0263.453] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0263.453] lstrlenW (lpString=".ppt") returned 4 [0263.453] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0263.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.453] lstrlenW (lpString=".zip") returned 4 [0263.453] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0263.453] lstrlenW (lpString=".rar") returned 4 [0263.453] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0263.453] lstrlenW (lpString=".bz2") returned 4 [0263.453] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0263.454] lstrlenW (lpString=".7z") returned 3 [0263.454] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0263.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.454] lstrlenW (lpString=".dbf") returned 4 [0263.454] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.454] lstrlenW (lpString=".1cd") returned 4 [0263.454] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0263.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.454] lstrlenW (lpString=".jpg") returned 4 [0263.454] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.454] lstrlenW (lpString=".doc") returned 4 [0263.454] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString=".docx") returned 5 [0263.454] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0263.454] lstrlenW (lpString=".pdf") returned 4 [0263.454] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString=".xls") returned 4 [0263.454] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString=".xlsx") returned 5 [0263.454] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0263.454] lstrlenW (lpString=".ppt") returned 4 [0263.454] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.454] lstrlenW (lpString=".zip") returned 4 [0263.454] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString=".rar") returned 4 [0263.454] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0263.454] lstrlenW (lpString=".bz2") returned 4 [0263.454] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0263.454] lstrlenW (lpString=".7z") returned 3 [0263.455] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0263.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.455] lstrlenW (lpString=".dbf") returned 4 [0263.455] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0263.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.455] lstrlenW (lpString=".1cd") returned 4 [0263.455] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0263.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0263.455] lstrlenW (lpString=".jpg") returned 4 [0263.455] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0263.455] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.455] lstrlenW (lpString="AccessMUI.xml") returned 13 [0263.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.585] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1349) returned 1 [0263.586] CloseHandle (hObject=0x190) returned 1 [0263.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0263.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.587] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.587] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0263.588] GetLastError () returned 0x0 [0263.588] ReadFile (in: hFile=0x190, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x545, lpOverlapped=0x0) returned 1 [0263.946] WriteFile (in: hFile=0x184, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x550, lpOverlapped=0x0) returned 1 [0263.947] ReadFile (in: hFile=0x190, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.947] WriteFile (in: hFile=0x184, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xee, lpOverlapped=0x0) returned 1 [0263.947] SetEndOfFile (hFile=0x184) returned 1 [0263.947] CloseHandle (hObject=0x184) returned 1 [0263.948] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.948] SetEndOfFile (hFile=0x190) returned 1 [0263.948] CloseHandle (hObject=0x190) returned 1 [0263.948] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.949] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0263.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.949] lstrlenW (lpString=".doc") returned 4 [0263.949] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.949] lstrlenW (lpString=".docx") returned 5 [0263.949] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.949] lstrlenW (lpString=".pdf") returned 4 [0263.949] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.949] lstrlenW (lpString=".xls") returned 4 [0263.949] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.949] lstrlenW (lpString=".xlsx") returned 5 [0263.949] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.949] lstrlenW (lpString=".ppt") returned 4 [0263.949] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.949] lstrlenW (lpString=".zip") returned 4 [0263.949] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.949] lstrlenW (lpString=".rar") returned 4 [0263.949] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.949] lstrlenW (lpString=".bz2") returned 4 [0263.949] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.949] lstrlenW (lpString=".7z") returned 3 [0263.949] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".dbf") returned 4 [0263.950] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".1cd") returned 4 [0263.950] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".jpg") returned 4 [0263.950] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".doc") returned 4 [0263.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString=".docx") returned 5 [0263.950] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.950] lstrlenW (lpString=".pdf") returned 4 [0263.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString=".xls") returned 4 [0263.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString=".xlsx") returned 5 [0263.950] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.950] lstrlenW (lpString=".ppt") returned 4 [0263.950] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".zip") returned 4 [0263.950] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.950] lstrlenW (lpString=".rar") returned 4 [0263.950] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString=".bz2") returned 4 [0263.950] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString=".7z") returned 3 [0263.950] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".dbf") returned 4 [0263.950] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.950] lstrlenW (lpString=".1cd") returned 4 [0263.950] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0263.951] lstrlenW (lpString=".jpg") returned 4 [0263.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.951] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.951] lstrlenW (lpString="Office32WW.xml") returned 14 [0263.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0263.986] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=4274) returned 1 [0263.986] CloseHandle (hObject=0x19c) returned 1 [0263.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0263.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0263.986] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.987] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0263.987] GetLastError () returned 0x0 [0263.987] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0263.997] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0263.998] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.998] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0263.998] SetEndOfFile (hFile=0x1b0) returned 1 [0264.008] CloseHandle (hObject=0x1b0) returned 1 [0264.009] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.009] SetEndOfFile (hFile=0x19c) returned 1 [0264.010] CloseHandle (hObject=0x19c) returned 1 [0264.010] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.010] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0264.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.011] lstrlenW (lpString=".doc") returned 4 [0264.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString=".docx") returned 5 [0264.011] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.011] lstrlenW (lpString=".pdf") returned 4 [0264.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString=".xls") returned 4 [0264.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString=".xlsx") returned 5 [0264.011] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.011] lstrlenW (lpString=".ppt") returned 4 [0264.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.011] lstrlenW (lpString=".zip") returned 4 [0264.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.011] lstrlenW (lpString=".rar") returned 4 [0264.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString=".bz2") returned 4 [0264.011] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString=".7z") returned 3 [0264.011] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.011] lstrlenW (lpString=".dbf") returned 4 [0264.011] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.011] lstrlenW (lpString=".1cd") returned 4 [0264.011] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString=".jpg") returned 4 [0264.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString=".doc") returned 4 [0264.012] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString=".docx") returned 5 [0264.012] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.012] lstrlenW (lpString=".pdf") returned 4 [0264.012] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString=".xls") returned 4 [0264.012] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString=".xlsx") returned 5 [0264.012] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.012] lstrlenW (lpString=".ppt") returned 4 [0264.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString=".zip") returned 4 [0264.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.012] lstrlenW (lpString=".rar") returned 4 [0264.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString=".bz2") returned 4 [0264.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString=".7z") returned 3 [0264.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString=".dbf") returned 4 [0264.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString=".1cd") returned 4 [0264.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.012] lstrlenW (lpString=".jpg") returned 4 [0264.013] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.013] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.013] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0264.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.014] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=6421) returned 1 [0264.014] CloseHandle (hObject=0x19c) returned 1 [0264.014] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0264.014] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.014] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.014] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0264.014] GetLastError () returned 0x0 [0264.014] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x1915, lpOverlapped=0x0) returned 1 [0264.026] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0264.027] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.027] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xee, lpOverlapped=0x0) returned 1 [0264.027] SetEndOfFile (hFile=0x1b0) returned 1 [0264.028] CloseHandle (hObject=0x1b0) returned 1 [0264.028] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.028] SetEndOfFile (hFile=0x19c) returned 1 [0264.029] CloseHandle (hObject=0x19c) returned 1 [0264.029] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.029] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString=".doc") returned 4 [0264.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString=".docx") returned 5 [0264.030] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.030] lstrlenW (lpString=".pdf") returned 4 [0264.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString=".xls") returned 4 [0264.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString=".xlsx") returned 5 [0264.030] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.030] lstrlenW (lpString=".ppt") returned 4 [0264.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString=".zip") returned 4 [0264.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.030] lstrlenW (lpString=".rar") returned 4 [0264.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString=".bz2") returned 4 [0264.030] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString=".7z") returned 3 [0264.030] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString=".dbf") returned 4 [0264.030] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString=".1cd") returned 4 [0264.030] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString=".jpg") returned 4 [0264.030] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.030] lstrlenW (lpString=".doc") returned 4 [0264.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString=".docx") returned 5 [0264.031] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.031] lstrlenW (lpString=".pdf") returned 4 [0264.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString=".xls") returned 4 [0264.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString=".xlsx") returned 5 [0264.031] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.031] lstrlenW (lpString=".ppt") returned 4 [0264.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.031] lstrlenW (lpString=".zip") returned 4 [0264.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.031] lstrlenW (lpString=".rar") returned 4 [0264.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString=".bz2") returned 4 [0264.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString=".7z") returned 3 [0264.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.031] lstrlenW (lpString=".dbf") returned 4 [0264.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.031] lstrlenW (lpString=".1cd") returned 4 [0264.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0264.031] lstrlenW (lpString=".jpg") returned 4 [0264.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.031] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.031] lstrlenW (lpString="Office32WW.xml") returned 14 [0264.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.032] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=4274) returned 1 [0264.032] CloseHandle (hObject=0x19c) returned 1 [0264.032] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0264.032] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.033] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.033] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0264.033] GetLastError () returned 0x0 [0264.033] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0264.040] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0264.041] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.041] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0264.041] SetEndOfFile (hFile=0x1b0) returned 1 [0264.041] CloseHandle (hObject=0x1b0) returned 1 [0264.042] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.042] SetEndOfFile (hFile=0x19c) returned 1 [0264.042] CloseHandle (hObject=0x19c) returned 1 [0264.043] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.043] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0264.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.043] lstrlenW (lpString=".doc") returned 4 [0264.043] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.043] lstrlenW (lpString=".docx") returned 5 [0264.043] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.043] lstrlenW (lpString=".pdf") returned 4 [0264.043] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.043] lstrlenW (lpString=".xls") returned 4 [0264.043] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString=".xlsx") returned 5 [0264.044] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.044] lstrlenW (lpString=".ppt") returned 4 [0264.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.044] lstrlenW (lpString=".zip") returned 4 [0264.044] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.044] lstrlenW (lpString=".rar") returned 4 [0264.044] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString=".bz2") returned 4 [0264.044] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString=".7z") returned 3 [0264.044] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.044] lstrlenW (lpString=".dbf") returned 4 [0264.044] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.044] lstrlenW (lpString=".1cd") returned 4 [0264.044] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.044] lstrlenW (lpString=".jpg") returned 4 [0264.044] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.044] lstrlenW (lpString=".doc") returned 4 [0264.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString=".docx") returned 5 [0264.044] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.044] lstrlenW (lpString=".pdf") returned 4 [0264.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString=".xls") returned 4 [0264.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.044] lstrlenW (lpString=".xlsx") returned 5 [0264.044] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.044] lstrlenW (lpString=".ppt") returned 4 [0264.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.045] lstrlenW (lpString=".zip") returned 4 [0264.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.045] lstrlenW (lpString=".rar") returned 4 [0264.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.045] lstrlenW (lpString=".bz2") returned 4 [0264.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.045] lstrlenW (lpString=".7z") returned 3 [0264.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.045] lstrlenW (lpString=".dbf") returned 4 [0264.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.045] lstrlenW (lpString=".1cd") returned 4 [0264.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.045] lstrlenW (lpString=".jpg") returned 4 [0264.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.045] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.045] lstrlenW (lpString="VisiorWW.xml") returned 12 [0264.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.046] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=8723) returned 1 [0264.046] CloseHandle (hObject=0x19c) returned 1 [0264.046] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0264.046] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.046] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.046] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0264.047] GetLastError () returned 0x0 [0264.047] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x2213, lpOverlapped=0x0) returned 1 [0264.182] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0264.183] ReadFile (in: hFile=0x19c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.183] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.183] SetEndOfFile (hFile=0x1b0) returned 1 [0264.183] CloseHandle (hObject=0x1b0) returned 1 [0264.184] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.184] SetEndOfFile (hFile=0x19c) returned 1 [0264.185] CloseHandle (hObject=0x19c) returned 1 [0264.185] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.186] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0264.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.186] lstrlenW (lpString=".doc") returned 4 [0264.186] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.186] lstrlenW (lpString=".docx") returned 5 [0264.186] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.186] lstrlenW (lpString=".pdf") returned 4 [0264.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.186] lstrlenW (lpString=".xls") returned 4 [0264.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.186] lstrlenW (lpString=".xlsx") returned 5 [0264.186] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.186] lstrlenW (lpString=".ppt") returned 4 [0264.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.186] lstrlenW (lpString=".zip") returned 4 [0264.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.186] lstrlenW (lpString=".rar") returned 4 [0264.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString=".bz2") returned 4 [0264.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString=".7z") returned 3 [0264.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.187] lstrlenW (lpString=".dbf") returned 4 [0264.187] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.187] lstrlenW (lpString=".1cd") returned 4 [0264.187] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.187] lstrlenW (lpString=".jpg") returned 4 [0264.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.187] lstrlenW (lpString=".doc") returned 4 [0264.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString=".docx") returned 5 [0264.187] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.187] lstrlenW (lpString=".pdf") returned 4 [0264.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString=".xls") returned 4 [0264.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.187] lstrlenW (lpString=".xlsx") returned 5 [0264.187] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.187] lstrlenW (lpString=".ppt") returned 4 [0264.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.188] lstrlenW (lpString=".zip") returned 4 [0264.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.188] lstrlenW (lpString=".rar") returned 4 [0264.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.188] lstrlenW (lpString=".bz2") returned 4 [0264.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.188] lstrlenW (lpString=".7z") returned 3 [0264.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.188] lstrlenW (lpString=".dbf") returned 4 [0264.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.188] lstrlenW (lpString=".1cd") returned 4 [0264.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0264.188] lstrlenW (lpString=".jpg") returned 4 [0264.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.188] lstrcmpiW (lpString1=".JPG", lpString2=".drweb") returned 1 [0264.188] lstrlenW (lpString="MS.JPG") returned 6 [0264.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0264.202] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1061) returned 1 [0264.202] CloseHandle (hObject=0x184) returned 1 [0264.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0264.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0264.202] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.202] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0264.203] GetLastError () returned 0x0 [0264.203] ReadFile (in: hFile=0x184, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x425, lpOverlapped=0x0) returned 1 [0264.214] WriteFile (in: hFile=0x19c, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x430, lpOverlapped=0x0) returned 1 [0264.215] ReadFile (in: hFile=0x184, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.215] WriteFile (in: hFile=0x19c, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0264.215] SetEndOfFile (hFile=0x19c) returned 1 [0264.215] CloseHandle (hObject=0x19c) returned 1 [0264.216] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.216] SetEndOfFile (hFile=0x184) returned 1 [0264.217] CloseHandle (hObject=0x184) returned 1 [0264.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0264.218] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0264.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.218] lstrlenW (lpString=".doc") returned 4 [0264.218] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.218] lstrlenW (lpString=".docx") returned 5 [0264.218] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0264.218] lstrlenW (lpString=".pdf") returned 4 [0264.218] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.218] lstrlenW (lpString=".xls") returned 4 [0264.218] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.218] lstrlenW (lpString=".xlsx") returned 5 [0264.218] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0264.218] lstrlenW (lpString=".ppt") returned 4 [0264.218] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.219] lstrlenW (lpString=".zip") returned 4 [0264.219] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.219] lstrlenW (lpString=".rar") returned 4 [0264.219] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.219] lstrlenW (lpString=".bz2") returned 4 [0264.219] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.219] lstrlenW (lpString=".7z") returned 3 [0264.219] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.219] lstrlenW (lpString=".dbf") returned 4 [0264.219] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.219] lstrlenW (lpString=".1cd") returned 4 [0264.219] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.219] lstrlenW (lpString=".jpg") returned 4 [0264.219] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.220] lstrlenW (lpString=".doc") returned 4 [0264.220] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0264.220] lstrlenW (lpString=".docx") returned 5 [0264.220] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0264.220] lstrlenW (lpString=".pdf") returned 4 [0264.220] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0264.220] lstrlenW (lpString=".xls") returned 4 [0264.220] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0264.220] lstrlenW (lpString=".xlsx") returned 5 [0264.220] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0264.220] lstrlenW (lpString=".ppt") returned 4 [0264.220] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0264.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.220] lstrlenW (lpString=".zip") returned 4 [0264.220] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0264.220] lstrlenW (lpString=".rar") returned 4 [0264.220] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0264.220] lstrlenW (lpString=".bz2") returned 4 [0264.220] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0264.220] lstrlenW (lpString=".7z") returned 3 [0264.220] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0264.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.220] lstrlenW (lpString=".dbf") returned 4 [0264.221] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0264.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.221] lstrlenW (lpString=".1cd") returned 4 [0264.221] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0264.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0264.221] lstrlenW (lpString=".jpg") returned 4 [0264.221] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0264.221] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.221] lstrlenW (lpString="Alphabet.xml") returned 12 [0264.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.249] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=791686) returned 1 [0264.249] CloseHandle (hObject=0x1c0) returned 1 [0264.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0264.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.249] lstrlenW (lpString=".doc") returned 4 [0264.249] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.249] lstrlenW (lpString=".docx") returned 5 [0264.249] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0264.249] lstrlenW (lpString=".pdf") returned 4 [0264.249] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.249] lstrlenW (lpString=".xls") returned 4 [0264.249] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.249] lstrlenW (lpString=".xlsx") returned 5 [0264.250] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0264.250] lstrlenW (lpString=".ppt") returned 4 [0264.250] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.250] lstrlenW (lpString=".zip") returned 4 [0264.250] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.250] lstrlenW (lpString=".rar") returned 4 [0264.250] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString=".bz2") returned 4 [0264.250] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString=".7z") returned 3 [0264.250] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.250] lstrlenW (lpString=".dbf") returned 4 [0264.250] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.250] lstrlenW (lpString=".1cd") returned 4 [0264.250] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.250] lstrlenW (lpString=".jpg") returned 4 [0264.250] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.250] lstrlenW (lpString=".doc") returned 4 [0264.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.250] lstrlenW (lpString=".docx") returned 5 [0264.251] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0264.251] lstrlenW (lpString=".pdf") returned 4 [0264.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString=".xls") returned 4 [0264.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString=".xlsx") returned 5 [0264.251] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0264.251] lstrlenW (lpString=".ppt") returned 4 [0264.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.251] lstrlenW (lpString=".zip") returned 4 [0264.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.251] lstrlenW (lpString=".rar") returned 4 [0264.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString=".bz2") returned 4 [0264.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString=".7z") returned 3 [0264.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.251] lstrlenW (lpString=".dbf") returned 4 [0264.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.251] lstrlenW (lpString=".1cd") returned 4 [0264.251] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0264.251] lstrlenW (lpString=".jpg") returned 4 [0264.251] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.258] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.258] lstrlenW (lpString="boxed-join.avi") returned 14 [0264.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.286] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=33280) returned 1 [0264.286] CloseHandle (hObject=0x1c0) returned 1 [0264.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0264.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.287] lstrlenW (lpString=".doc") returned 4 [0264.287] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.287] lstrlenW (lpString=".docx") returned 5 [0264.287] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0264.287] lstrlenW (lpString=".pdf") returned 4 [0264.287] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.287] lstrlenW (lpString=".xls") returned 4 [0264.287] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.287] lstrlenW (lpString=".xlsx") returned 5 [0264.287] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0264.287] lstrlenW (lpString=".ppt") returned 4 [0264.287] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.287] lstrlenW (lpString=".zip") returned 4 [0264.287] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.287] lstrlenW (lpString=".rar") returned 4 [0264.287] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.287] lstrlenW (lpString=".bz2") returned 4 [0264.287] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.288] lstrlenW (lpString=".7z") returned 3 [0264.288] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.288] lstrlenW (lpString=".dbf") returned 4 [0264.288] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.288] lstrlenW (lpString=".1cd") returned 4 [0264.288] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.288] lstrlenW (lpString=".jpg") returned 4 [0264.288] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.288] lstrlenW (lpString=".doc") returned 4 [0264.288] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.288] lstrlenW (lpString=".docx") returned 5 [0264.288] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0264.288] lstrlenW (lpString=".pdf") returned 4 [0264.288] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.288] lstrlenW (lpString=".xls") returned 4 [0264.288] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.288] lstrlenW (lpString=".xlsx") returned 5 [0264.288] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0264.288] lstrlenW (lpString=".ppt") returned 4 [0264.289] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.289] lstrlenW (lpString=".zip") returned 4 [0264.289] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.289] lstrlenW (lpString=".rar") returned 4 [0264.289] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.289] lstrlenW (lpString=".bz2") returned 4 [0264.289] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.289] lstrlenW (lpString=".7z") returned 3 [0264.289] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.289] lstrlenW (lpString=".dbf") returned 4 [0264.289] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.289] lstrlenW (lpString=".1cd") returned 4 [0264.289] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0264.289] lstrlenW (lpString=".jpg") returned 4 [0264.289] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.289] Sleep (dwMilliseconds=0x64) [0264.742] Sleep (dwMilliseconds=0x64) [0265.025] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.025] lstrlenW (lpString="keypadbase.xml") returned 14 [0265.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.145] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1118) returned 1 [0265.146] CloseHandle (hObject=0x1c4) returned 1 [0265.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0265.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.146] lstrlenW (lpString=".doc") returned 4 [0265.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.146] lstrlenW (lpString=".docx") returned 5 [0265.146] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0265.146] lstrlenW (lpString=".pdf") returned 4 [0265.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.146] lstrlenW (lpString=".xls") returned 4 [0265.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.146] lstrlenW (lpString=".xlsx") returned 5 [0265.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0265.146] lstrlenW (lpString=".ppt") returned 4 [0265.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.146] lstrlenW (lpString=".zip") returned 4 [0265.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.147] lstrlenW (lpString=".rar") returned 4 [0265.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString=".bz2") returned 4 [0265.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString=".7z") returned 3 [0265.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.147] lstrlenW (lpString=".dbf") returned 4 [0265.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.147] lstrlenW (lpString=".1cd") returned 4 [0265.147] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.147] lstrlenW (lpString=".jpg") returned 4 [0265.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.147] lstrlenW (lpString=".doc") returned 4 [0265.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString=".docx") returned 5 [0265.147] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0265.147] lstrlenW (lpString=".pdf") returned 4 [0265.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString=".xls") returned 4 [0265.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.147] lstrlenW (lpString=".xlsx") returned 5 [0265.147] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0265.148] lstrlenW (lpString=".ppt") returned 4 [0265.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.148] lstrlenW (lpString=".zip") returned 4 [0265.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.148] lstrlenW (lpString=".rar") returned 4 [0265.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.148] lstrlenW (lpString=".bz2") returned 4 [0265.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.148] lstrlenW (lpString=".7z") returned 3 [0265.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.148] lstrlenW (lpString=".dbf") returned 4 [0265.148] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.148] lstrlenW (lpString=".1cd") returned 4 [0265.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0265.149] lstrlenW (lpString=".jpg") returned 4 [0265.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.151] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.151] lstrlenW (lpString="base_ca.xml") returned 11 [0265.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.180] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=3166) returned 1 [0265.180] CloseHandle (hObject=0x1c4) returned 1 [0265.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0265.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.181] lstrlenW (lpString=".doc") returned 4 [0265.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.181] lstrlenW (lpString=".docx") returned 5 [0265.181] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0265.181] lstrlenW (lpString=".pdf") returned 4 [0265.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.181] lstrlenW (lpString=".xls") returned 4 [0265.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.181] lstrlenW (lpString=".xlsx") returned 5 [0265.181] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0265.181] lstrlenW (lpString=".ppt") returned 4 [0265.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.182] lstrlenW (lpString=".zip") returned 4 [0265.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.182] lstrlenW (lpString=".rar") returned 4 [0265.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString=".bz2") returned 4 [0265.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString=".7z") returned 3 [0265.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.182] lstrlenW (lpString=".dbf") returned 4 [0265.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.182] lstrlenW (lpString=".1cd") returned 4 [0265.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.182] lstrlenW (lpString=".jpg") returned 4 [0265.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.182] lstrlenW (lpString=".doc") returned 4 [0265.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.182] lstrlenW (lpString=".docx") returned 5 [0265.182] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0265.182] lstrlenW (lpString=".pdf") returned 4 [0265.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.183] lstrlenW (lpString=".xls") returned 4 [0265.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.183] lstrlenW (lpString=".xlsx") returned 5 [0265.183] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0265.183] lstrlenW (lpString=".ppt") returned 4 [0265.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.183] lstrlenW (lpString=".zip") returned 4 [0265.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.183] lstrlenW (lpString=".rar") returned 4 [0265.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.183] lstrlenW (lpString=".bz2") returned 4 [0265.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.183] lstrlenW (lpString=".7z") returned 3 [0265.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.183] lstrlenW (lpString=".dbf") returned 4 [0265.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.183] lstrlenW (lpString=".1cd") returned 4 [0265.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0265.191] lstrlenW (lpString=".jpg") returned 4 [0265.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.191] lstrcmpiW (lpString1=".dat", lpString2=".drweb") returned -1 [0265.191] lstrlenW (lpString="hwrenclm.dat") returned 12 [0265.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0266.477] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=815680) returned 1 [0266.477] CloseHandle (hObject=0x190) returned 1 [0266.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0266.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.477] lstrlenW (lpString=".doc") returned 4 [0266.477] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0266.477] lstrlenW (lpString=".docx") returned 5 [0266.477] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0266.477] lstrlenW (lpString=".pdf") returned 4 [0266.477] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0266.477] lstrlenW (lpString=".xls") returned 4 [0266.477] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0266.477] lstrlenW (lpString=".xlsx") returned 5 [0266.477] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0266.477] lstrlenW (lpString=".ppt") returned 4 [0266.477] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.478] lstrlenW (lpString=".zip") returned 4 [0266.478] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString=".rar") returned 4 [0266.478] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString=".bz2") returned 4 [0266.478] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0266.478] lstrlenW (lpString=".7z") returned 3 [0266.478] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0266.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.478] lstrlenW (lpString=".dbf") returned 4 [0266.478] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.478] lstrlenW (lpString=".1cd") returned 4 [0266.478] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0266.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.478] lstrlenW (lpString=".jpg") returned 4 [0266.478] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.478] lstrlenW (lpString=".doc") returned 4 [0266.478] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString=".docx") returned 5 [0266.478] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0266.478] lstrlenW (lpString=".pdf") returned 4 [0266.478] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0266.478] lstrlenW (lpString=".xls") returned 4 [0266.478] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0266.479] lstrlenW (lpString=".xlsx") returned 5 [0266.479] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0266.479] lstrlenW (lpString=".ppt") returned 4 [0266.479] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0266.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.479] lstrlenW (lpString=".zip") returned 4 [0266.479] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0266.479] lstrlenW (lpString=".rar") returned 4 [0266.479] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0266.479] lstrlenW (lpString=".bz2") returned 4 [0266.479] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0266.479] lstrlenW (lpString=".7z") returned 3 [0266.479] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0266.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.479] lstrlenW (lpString=".dbf") returned 4 [0266.479] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0266.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.479] lstrlenW (lpString=".1cd") returned 4 [0266.479] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0266.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0266.479] lstrlenW (lpString=".jpg") returned 4 [0266.479] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0266.479] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.479] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0266.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.559] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=819) returned 1 [0266.559] CloseHandle (hObject=0x1c4) returned 1 [0266.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0266.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.559] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.559] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0266.560] GetLastError () returned 0x0 [0266.560] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x333, lpOverlapped=0x0) returned 1 [0266.571] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x340, lpOverlapped=0x0) returned 1 [0266.572] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.572] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0266.572] SetEndOfFile (hFile=0x1c8) returned 1 [0266.572] CloseHandle (hObject=0x1c8) returned 1 [0266.573] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.573] SetEndOfFile (hFile=0x1c4) returned 1 [0266.574] CloseHandle (hObject=0x1c4) returned 1 [0266.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.575] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0266.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.575] lstrlenW (lpString=".doc") returned 4 [0266.575] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.575] lstrlenW (lpString=".docx") returned 5 [0266.575] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0266.576] lstrlenW (lpString=".pdf") returned 4 [0266.576] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString=".xls") returned 4 [0266.576] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString=".xlsx") returned 5 [0266.576] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0266.576] lstrlenW (lpString=".ppt") returned 4 [0266.576] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.576] lstrlenW (lpString=".zip") returned 4 [0266.576] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.576] lstrlenW (lpString=".rar") returned 4 [0266.576] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString=".bz2") returned 4 [0266.576] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString=".7z") returned 3 [0266.576] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.576] lstrlenW (lpString=".dbf") returned 4 [0266.576] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.576] lstrlenW (lpString=".1cd") returned 4 [0266.576] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.576] lstrlenW (lpString=".jpg") returned 4 [0266.576] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.577] lstrlenW (lpString=".doc") returned 4 [0266.577] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString=".docx") returned 5 [0266.577] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0266.577] lstrlenW (lpString=".pdf") returned 4 [0266.577] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString=".xls") returned 4 [0266.577] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString=".xlsx") returned 5 [0266.577] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0266.577] lstrlenW (lpString=".ppt") returned 4 [0266.577] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.577] lstrlenW (lpString=".zip") returned 4 [0266.577] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.577] lstrlenW (lpString=".rar") returned 4 [0266.577] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString=".bz2") returned 4 [0266.577] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString=".7z") returned 3 [0266.577] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.577] lstrlenW (lpString=".dbf") returned 4 [0266.577] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.577] lstrlenW (lpString=".1cd") returned 4 [0266.578] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0266.578] lstrlenW (lpString=".jpg") returned 4 [0266.578] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.578] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.578] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0266.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.578] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1565) returned 1 [0266.578] CloseHandle (hObject=0x1c4) returned 1 [0266.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0266.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.579] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.579] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0266.579] GetLastError () returned 0x0 [0266.579] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x61d, lpOverlapped=0x0) returned 1 [0266.589] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x620, lpOverlapped=0x0) returned 1 [0266.590] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.590] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.590] SetEndOfFile (hFile=0x1c8) returned 1 [0266.590] CloseHandle (hObject=0x1c8) returned 1 [0266.592] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.592] SetEndOfFile (hFile=0x1c4) returned 1 [0266.593] CloseHandle (hObject=0x1c4) returned 1 [0266.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.593] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0266.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.594] lstrlenW (lpString=".doc") returned 4 [0266.594] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.594] lstrlenW (lpString=".docx") returned 5 [0266.594] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0266.594] lstrlenW (lpString=".pdf") returned 4 [0266.594] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.594] lstrlenW (lpString=".xls") returned 4 [0266.594] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.594] lstrlenW (lpString=".xlsx") returned 5 [0266.594] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0266.594] lstrlenW (lpString=".ppt") returned 4 [0266.594] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.594] lstrlenW (lpString=".zip") returned 4 [0266.594] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.594] lstrlenW (lpString=".rar") returned 4 [0266.594] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.594] lstrlenW (lpString=".bz2") returned 4 [0266.594] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.594] lstrlenW (lpString=".7z") returned 3 [0266.594] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.595] lstrlenW (lpString=".dbf") returned 4 [0266.595] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.595] lstrlenW (lpString=".1cd") returned 4 [0266.595] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.595] lstrlenW (lpString=".jpg") returned 4 [0266.595] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.595] lstrlenW (lpString=".doc") returned 4 [0266.595] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString=".docx") returned 5 [0266.595] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0266.595] lstrlenW (lpString=".pdf") returned 4 [0266.595] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString=".xls") returned 4 [0266.595] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString=".xlsx") returned 5 [0266.595] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0266.595] lstrlenW (lpString=".ppt") returned 4 [0266.595] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.595] lstrlenW (lpString=".zip") returned 4 [0266.595] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.595] lstrlenW (lpString=".rar") returned 4 [0266.596] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.596] lstrlenW (lpString=".bz2") returned 4 [0266.596] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.596] lstrlenW (lpString=".7z") returned 3 [0266.596] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.596] lstrlenW (lpString=".dbf") returned 4 [0266.596] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.596] lstrlenW (lpString=".1cd") returned 4 [0266.596] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0266.596] lstrlenW (lpString=".jpg") returned 4 [0266.596] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.596] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.597] lstrlenW (lpString="SETUP.XML") returned 9 [0266.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0266.602] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2296) returned 1 [0266.602] CloseHandle (hObject=0x164) returned 1 [0266.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0266.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0266.603] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.603] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.606] GetLastError () returned 0x0 [0266.606] ReadFile (in: hFile=0x164, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0266.637] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x900, lpOverlapped=0x0) returned 1 [0266.638] ReadFile (in: hFile=0x164, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.639] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0266.639] SetEndOfFile (hFile=0x1c4) returned 1 [0266.639] CloseHandle (hObject=0x1c4) returned 1 [0266.642] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.642] SetEndOfFile (hFile=0x164) returned 1 [0266.643] CloseHandle (hObject=0x164) returned 1 [0266.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.644] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0266.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.644] lstrlenW (lpString=".doc") returned 4 [0266.645] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.645] lstrlenW (lpString=".docx") returned 5 [0266.645] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0266.645] lstrlenW (lpString=".pdf") returned 4 [0266.645] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.645] lstrlenW (lpString=".xls") returned 4 [0266.645] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.645] lstrlenW (lpString=".xlsx") returned 5 [0266.645] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0266.645] lstrlenW (lpString=".ppt") returned 4 [0266.645] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.645] lstrlenW (lpString=".zip") returned 4 [0266.645] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.645] lstrlenW (lpString=".rar") returned 4 [0266.645] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.645] lstrlenW (lpString=".bz2") returned 4 [0266.645] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.645] lstrlenW (lpString=".7z") returned 3 [0266.645] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.646] lstrlenW (lpString=".dbf") returned 4 [0266.646] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.646] lstrlenW (lpString=".1cd") returned 4 [0266.646] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.646] lstrlenW (lpString=".jpg") returned 4 [0266.646] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.646] lstrlenW (lpString=".doc") returned 4 [0266.646] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.646] lstrlenW (lpString=".docx") returned 5 [0266.646] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0266.646] lstrlenW (lpString=".pdf") returned 4 [0266.646] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.646] lstrlenW (lpString=".xls") returned 4 [0266.646] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.646] lstrlenW (lpString=".xlsx") returned 5 [0266.646] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0266.647] lstrlenW (lpString=".ppt") returned 4 [0266.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.647] lstrlenW (lpString=".zip") returned 4 [0266.647] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.647] lstrlenW (lpString=".rar") returned 4 [0266.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.647] lstrlenW (lpString=".bz2") returned 4 [0266.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.647] lstrlenW (lpString=".7z") returned 3 [0266.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.647] lstrlenW (lpString=".dbf") returned 4 [0266.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.647] lstrlenW (lpString=".1cd") returned 4 [0266.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0266.647] lstrlenW (lpString=".jpg") returned 4 [0266.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.648] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.648] lstrlenW (lpString="SETUP.XML") returned 9 [0266.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.240] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1452) returned 1 [0267.244] CloseHandle (hObject=0x1f8) returned 1 [0267.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0267.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.268] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.268] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0267.269] GetLastError () returned 0x0 [0267.269] ReadFile (in: hFile=0x1f8, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0267.312] WriteFile (in: hFile=0x1fc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0267.314] ReadFile (in: hFile=0x1f8, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.314] WriteFile (in: hFile=0x1fc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0267.314] SetEndOfFile (hFile=0x1fc) returned 1 [0267.314] CloseHandle (hObject=0x1fc) returned 1 [0267.315] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.315] SetEndOfFile (hFile=0x1f8) returned 1 [0267.316] CloseHandle (hObject=0x1f8) returned 1 [0267.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.316] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0267.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.317] lstrlenW (lpString=".doc") returned 4 [0267.317] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.317] lstrlenW (lpString=".docx") returned 5 [0267.317] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0267.317] lstrlenW (lpString=".pdf") returned 4 [0267.317] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.317] lstrlenW (lpString=".xls") returned 4 [0267.317] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.317] lstrlenW (lpString=".xlsx") returned 5 [0267.317] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0267.317] lstrlenW (lpString=".ppt") returned 4 [0267.317] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.317] lstrlenW (lpString=".zip") returned 4 [0267.317] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.317] lstrlenW (lpString=".rar") returned 4 [0267.317] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.317] lstrlenW (lpString=".bz2") returned 4 [0267.317] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.317] lstrlenW (lpString=".7z") returned 3 [0267.317] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.317] lstrlenW (lpString=".dbf") returned 4 [0267.318] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.318] lstrlenW (lpString=".1cd") returned 4 [0267.318] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.318] lstrlenW (lpString=".jpg") returned 4 [0267.318] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.318] lstrlenW (lpString=".doc") returned 4 [0267.318] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString=".docx") returned 5 [0267.318] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0267.318] lstrlenW (lpString=".pdf") returned 4 [0267.318] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString=".xls") returned 4 [0267.318] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString=".xlsx") returned 5 [0267.318] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0267.318] lstrlenW (lpString=".ppt") returned 4 [0267.318] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.318] lstrlenW (lpString=".zip") returned 4 [0267.318] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.318] lstrlenW (lpString=".rar") returned 4 [0267.318] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.318] lstrlenW (lpString=".bz2") returned 4 [0267.319] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.319] lstrlenW (lpString=".7z") returned 3 [0267.319] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.319] lstrlenW (lpString=".dbf") returned 4 [0267.319] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.319] lstrlenW (lpString=".1cd") returned 4 [0267.319] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0267.319] lstrlenW (lpString=".jpg") returned 4 [0267.319] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.319] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0267.319] lstrlenW (lpString="SETUP.CHM") returned 9 [0267.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.322] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=67190) returned 1 [0267.323] CloseHandle (hObject=0x1f4) returned 1 [0267.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0267.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.323] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.323] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0267.323] GetLastError () returned 0x0 [0267.323] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x10676, lpOverlapped=0x0) returned 1 [0267.335] WriteFile (in: hFile=0x1ec, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0267.337] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.337] WriteFile (in: hFile=0x1ec, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0267.337] SetEndOfFile (hFile=0x1ec) returned 1 [0267.337] CloseHandle (hObject=0x1ec) returned 1 [0267.339] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.339] SetEndOfFile (hFile=0x1f4) returned 1 [0267.340] CloseHandle (hObject=0x1f4) returned 1 [0267.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.340] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0267.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.340] lstrlenW (lpString=".doc") returned 4 [0267.340] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.340] lstrlenW (lpString=".docx") returned 5 [0267.340] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0267.340] lstrlenW (lpString=".pdf") returned 4 [0267.340] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.395] lstrlenW (lpString=".xls") returned 4 [0267.397] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.397] lstrlenW (lpString=".xlsx") returned 5 [0267.397] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0267.397] lstrlenW (lpString=".ppt") returned 4 [0267.397] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.397] lstrlenW (lpString=".zip") returned 4 [0267.397] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.397] lstrlenW (lpString=".rar") returned 4 [0267.397] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.397] lstrlenW (lpString=".bz2") returned 4 [0267.397] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.397] lstrlenW (lpString=".7z") returned 3 [0267.397] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.397] lstrlenW (lpString=".dbf") returned 4 [0267.397] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.397] lstrlenW (lpString=".1cd") returned 4 [0267.397] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.397] lstrlenW (lpString=".jpg") returned 4 [0267.397] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.398] lstrlenW (lpString=".doc") returned 4 [0267.398] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString=".docx") returned 5 [0267.398] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0267.398] lstrlenW (lpString=".pdf") returned 4 [0267.398] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString=".xls") returned 4 [0267.398] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString=".xlsx") returned 5 [0267.398] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0267.398] lstrlenW (lpString=".ppt") returned 4 [0267.398] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.398] lstrlenW (lpString=".zip") returned 4 [0267.398] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString=".rar") returned 4 [0267.398] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString=".bz2") returned 4 [0267.398] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.398] lstrlenW (lpString=".7z") returned 3 [0267.398] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.398] lstrlenW (lpString=".dbf") returned 4 [0267.398] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.398] lstrlenW (lpString=".1cd") returned 4 [0267.398] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0267.398] lstrlenW (lpString=".jpg") returned 4 [0267.399] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.399] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.399] lstrlenW (lpString="SETUP.XML") returned 9 [0267.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.399] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2362) returned 1 [0267.399] CloseHandle (hObject=0x1f4) returned 1 [0267.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0267.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.399] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.399] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0267.400] GetLastError () returned 0x0 [0267.400] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x93a, lpOverlapped=0x0) returned 1 [0267.413] WriteFile (in: hFile=0x1ec, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x940, lpOverlapped=0x0) returned 1 [0267.414] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.414] WriteFile (in: hFile=0x1ec, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0267.414] SetEndOfFile (hFile=0x1ec) returned 1 [0267.414] CloseHandle (hObject=0x1ec) returned 1 [0267.415] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.415] SetEndOfFile (hFile=0x1f4) returned 1 [0267.416] CloseHandle (hObject=0x1f4) returned 1 [0267.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0267.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.416] lstrlenW (lpString=".doc") returned 4 [0267.416] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.416] lstrlenW (lpString=".docx") returned 5 [0267.416] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0267.416] lstrlenW (lpString=".pdf") returned 4 [0267.416] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.416] lstrlenW (lpString=".xls") returned 4 [0267.416] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.416] lstrlenW (lpString=".xlsx") returned 5 [0267.416] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0267.417] lstrlenW (lpString=".ppt") returned 4 [0267.417] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.417] lstrlenW (lpString=".zip") returned 4 [0267.417] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.417] lstrlenW (lpString=".rar") returned 4 [0267.417] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString=".bz2") returned 4 [0267.417] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString=".7z") returned 3 [0267.417] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.417] lstrlenW (lpString=".dbf") returned 4 [0267.417] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.417] lstrlenW (lpString=".1cd") returned 4 [0267.417] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.417] lstrlenW (lpString=".jpg") returned 4 [0267.417] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.417] lstrlenW (lpString=".doc") returned 4 [0267.417] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.417] lstrlenW (lpString=".docx") returned 5 [0267.417] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0267.417] lstrlenW (lpString=".pdf") returned 4 [0267.418] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString=".xls") returned 4 [0267.418] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString=".xlsx") returned 5 [0267.418] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0267.418] lstrlenW (lpString=".ppt") returned 4 [0267.418] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.418] lstrlenW (lpString=".zip") returned 4 [0267.418] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.418] lstrlenW (lpString=".rar") returned 4 [0267.418] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString=".bz2") returned 4 [0267.418] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString=".7z") returned 3 [0267.418] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.418] lstrlenW (lpString=".dbf") returned 4 [0267.418] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.418] lstrlenW (lpString=".1cd") returned 4 [0267.418] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0267.418] lstrlenW (lpString=".jpg") returned 4 [0267.418] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.419] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.419] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0267.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.419] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1606) returned 1 [0267.419] CloseHandle (hObject=0x1f4) returned 1 [0267.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0267.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.420] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.420] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0267.435] GetLastError () returned 0x0 [0267.435] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x646, lpOverlapped=0x0) returned 1 [0267.800] WriteFile (in: hFile=0x1ec, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x650, lpOverlapped=0x0) returned 1 [0267.801] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.801] WriteFile (in: hFile=0x1ec, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0267.801] SetEndOfFile (hFile=0x1ec) returned 1 [0267.801] CloseHandle (hObject=0x1ec) returned 1 [0267.802] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.802] SetEndOfFile (hFile=0x1f4) returned 1 [0267.803] CloseHandle (hObject=0x1f4) returned 1 [0267.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.803] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0267.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.943] lstrlenW (lpString=".doc") returned 4 [0267.943] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.943] lstrlenW (lpString=".docx") returned 5 [0267.943] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.943] lstrlenW (lpString=".pdf") returned 4 [0267.943] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.943] lstrlenW (lpString=".xls") returned 4 [0267.943] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.943] lstrlenW (lpString=".xlsx") returned 5 [0267.943] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.943] lstrlenW (lpString=".ppt") returned 4 [0267.943] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.943] lstrlenW (lpString=".zip") returned 4 [0267.943] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.943] lstrlenW (lpString=".rar") returned 4 [0267.943] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.943] lstrlenW (lpString=".bz2") returned 4 [0267.943] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.943] lstrlenW (lpString=".7z") returned 3 [0267.943] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString=".dbf") returned 4 [0267.944] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString=".1cd") returned 4 [0267.944] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString=".jpg") returned 4 [0267.944] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString=".doc") returned 4 [0267.944] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString=".docx") returned 5 [0267.944] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.944] lstrlenW (lpString=".pdf") returned 4 [0267.944] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString=".xls") returned 4 [0267.944] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString=".xlsx") returned 5 [0267.944] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.944] lstrlenW (lpString=".ppt") returned 4 [0267.944] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString=".zip") returned 4 [0267.944] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.944] lstrlenW (lpString=".rar") returned 4 [0267.944] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString=".bz2") returned 4 [0267.944] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.944] lstrlenW (lpString=".7z") returned 3 [0267.944] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.944] lstrlenW (lpString=".dbf") returned 4 [0267.944] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.945] lstrlenW (lpString=".1cd") returned 4 [0267.945] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0267.945] lstrlenW (lpString=".jpg") returned 4 [0267.945] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.945] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.945] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0267.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0267.945] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1450) returned 1 [0267.945] CloseHandle (hObject=0x18c) returned 1 [0267.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0267.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0267.945] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.946] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0267.969] GetLastError () returned 0x0 [0267.969] ReadFile (in: hFile=0x18c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0268.101] WriteFile (in: hFile=0x1e8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0268.103] ReadFile (in: hFile=0x18c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.103] WriteFile (in: hFile=0x1e8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0268.103] SetEndOfFile (hFile=0x1e8) returned 1 [0268.103] CloseHandle (hObject=0x1e8) returned 1 [0268.104] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.104] SetEndOfFile (hFile=0x18c) returned 1 [0268.104] CloseHandle (hObject=0x18c) returned 1 [0268.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.105] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0268.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.105] lstrlenW (lpString=".doc") returned 4 [0268.105] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.105] lstrlenW (lpString=".docx") returned 5 [0268.105] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0268.105] lstrlenW (lpString=".pdf") returned 4 [0268.105] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.105] lstrlenW (lpString=".xls") returned 4 [0268.105] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.105] lstrlenW (lpString=".xlsx") returned 5 [0268.105] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0268.105] lstrlenW (lpString=".ppt") returned 4 [0268.105] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString=".zip") returned 4 [0268.106] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.106] lstrlenW (lpString=".rar") returned 4 [0268.106] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString=".bz2") returned 4 [0268.106] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString=".7z") returned 3 [0268.106] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString=".dbf") returned 4 [0268.106] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString=".1cd") returned 4 [0268.106] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString=".jpg") returned 4 [0268.106] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString=".doc") returned 4 [0268.106] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString=".docx") returned 5 [0268.106] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0268.106] lstrlenW (lpString=".pdf") returned 4 [0268.106] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString=".xls") returned 4 [0268.106] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString=".xlsx") returned 5 [0268.106] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0268.106] lstrlenW (lpString=".ppt") returned 4 [0268.106] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.106] lstrlenW (lpString=".zip") returned 4 [0268.107] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.107] lstrlenW (lpString=".rar") returned 4 [0268.107] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.107] lstrlenW (lpString=".bz2") returned 4 [0268.107] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.107] lstrlenW (lpString=".7z") returned 3 [0268.107] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.107] lstrlenW (lpString=".dbf") returned 4 [0268.107] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.107] lstrlenW (lpString=".1cd") returned 4 [0268.107] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0268.107] lstrlenW (lpString=".jpg") returned 4 [0268.107] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.107] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.107] lstrlenW (lpString="SETUP.XML") returned 9 [0268.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0268.172] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1886) returned 1 [0268.172] CloseHandle (hObject=0x1b0) returned 1 [0268.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0268.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0268.172] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.172] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0268.173] GetLastError () returned 0x0 [0268.173] ReadFile (in: hFile=0x1b0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x75e, lpOverlapped=0x0) returned 1 [0268.203] WriteFile (in: hFile=0x1e4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x760, lpOverlapped=0x0) returned 1 [0268.204] ReadFile (in: hFile=0x1b0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.204] WriteFile (in: hFile=0x1e4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.204] SetEndOfFile (hFile=0x1e4) returned 1 [0268.206] CloseHandle (hObject=0x1e4) returned 1 [0268.207] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.207] SetEndOfFile (hFile=0x1b0) returned 1 [0268.208] CloseHandle (hObject=0x1b0) returned 1 [0268.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0268.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.208] lstrlenW (lpString=".doc") returned 4 [0268.208] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.208] lstrlenW (lpString=".docx") returned 5 [0268.208] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.208] lstrlenW (lpString=".pdf") returned 4 [0268.208] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.208] lstrlenW (lpString=".xls") returned 4 [0268.209] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString=".xlsx") returned 5 [0268.209] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.209] lstrlenW (lpString=".ppt") returned 4 [0268.209] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.209] lstrlenW (lpString=".zip") returned 4 [0268.209] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.209] lstrlenW (lpString=".rar") returned 4 [0268.209] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString=".bz2") returned 4 [0268.209] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString=".7z") returned 3 [0268.209] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.209] lstrlenW (lpString=".dbf") returned 4 [0268.209] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.209] lstrlenW (lpString=".1cd") returned 4 [0268.209] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.209] lstrlenW (lpString=".jpg") returned 4 [0268.209] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.209] lstrlenW (lpString=".doc") returned 4 [0268.209] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.209] lstrlenW (lpString=".docx") returned 5 [0268.210] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.210] lstrlenW (lpString=".pdf") returned 4 [0268.210] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.210] lstrlenW (lpString=".xls") returned 4 [0268.210] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.210] lstrlenW (lpString=".xlsx") returned 5 [0268.210] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.210] lstrlenW (lpString=".ppt") returned 4 [0268.210] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.210] lstrlenW (lpString=".zip") returned 4 [0268.210] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.210] lstrlenW (lpString=".rar") returned 4 [0268.210] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.210] lstrlenW (lpString=".bz2") returned 4 [0268.210] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.210] lstrlenW (lpString=".7z") returned 3 [0268.210] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.210] lstrlenW (lpString=".dbf") returned 4 [0268.211] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.211] lstrlenW (lpString=".1cd") returned 4 [0268.211] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0268.211] lstrlenW (lpString=".jpg") returned 4 [0268.211] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.211] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.211] lstrlenW (lpString="SETUP.XML") returned 9 [0268.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0268.491] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=16683) returned 1 [0268.491] CloseHandle (hObject=0x1f4) returned 1 [0268.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0268.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0268.492] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.492] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0268.492] GetLastError () returned 0x0 [0268.492] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x412b, lpOverlapped=0x0) returned 1 [0268.521] WriteFile (in: hFile=0x1fc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0268.523] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.523] WriteFile (in: hFile=0x1fc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.523] SetEndOfFile (hFile=0x1fc) returned 1 [0269.189] CloseHandle (hObject=0x1fc) returned 1 [0269.321] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.321] SetEndOfFile (hFile=0x1f4) returned 1 [0269.322] CloseHandle (hObject=0x1f4) returned 1 [0269.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.323] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0269.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.323] lstrlenW (lpString=".doc") returned 4 [0269.323] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.323] lstrlenW (lpString=".docx") returned 5 [0269.323] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.323] lstrlenW (lpString=".pdf") returned 4 [0269.323] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.323] lstrlenW (lpString=".xls") returned 4 [0269.323] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.323] lstrlenW (lpString=".xlsx") returned 5 [0269.323] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.323] lstrlenW (lpString=".ppt") returned 4 [0269.323] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.325] lstrlenW (lpString=".zip") returned 4 [0269.325] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.325] lstrlenW (lpString=".rar") returned 4 [0269.325] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.325] lstrlenW (lpString=".bz2") returned 4 [0269.325] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.325] lstrlenW (lpString=".7z") returned 3 [0269.325] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.325] lstrlenW (lpString=".dbf") returned 4 [0269.325] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.325] lstrlenW (lpString=".1cd") returned 4 [0269.325] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.325] lstrlenW (lpString=".jpg") returned 4 [0269.325] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.325] lstrlenW (lpString=".doc") returned 4 [0269.326] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString=".docx") returned 5 [0269.326] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.326] lstrlenW (lpString=".pdf") returned 4 [0269.326] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString=".xls") returned 4 [0269.326] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString=".xlsx") returned 5 [0269.326] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.326] lstrlenW (lpString=".ppt") returned 4 [0269.326] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.326] lstrlenW (lpString=".zip") returned 4 [0269.326] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.326] lstrlenW (lpString=".rar") returned 4 [0269.326] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString=".bz2") returned 4 [0269.326] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString=".7z") returned 3 [0269.326] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.326] lstrlenW (lpString=".dbf") returned 4 [0269.326] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.330] lstrlenW (lpString=".1cd") returned 4 [0269.330] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0269.330] lstrlenW (lpString=".jpg") returned 4 [0269.330] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.339] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.339] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0269.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.339] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1450) returned 1 [0269.339] CloseHandle (hObject=0x18c) returned 1 [0269.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0269.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.340] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.340] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0269.677] GetLastError () returned 0x0 [0269.677] ReadFile (in: hFile=0x18c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0269.700] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0269.701] ReadFile (in: hFile=0x18c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.701] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0269.702] SetEndOfFile (hFile=0x174) returned 1 [0269.702] CloseHandle (hObject=0x174) returned 1 [0269.702] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.703] SetEndOfFile (hFile=0x18c) returned 1 [0269.703] CloseHandle (hObject=0x18c) returned 1 [0269.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.704] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0269.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.704] lstrlenW (lpString=".doc") returned 4 [0269.704] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.704] lstrlenW (lpString=".docx") returned 5 [0269.704] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0269.704] lstrlenW (lpString=".pdf") returned 4 [0269.704] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.704] lstrlenW (lpString=".xls") returned 4 [0269.704] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.704] lstrlenW (lpString=".xlsx") returned 5 [0269.704] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0269.704] lstrlenW (lpString=".ppt") returned 4 [0269.704] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.704] lstrlenW (lpString=".zip") returned 4 [0269.704] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.705] lstrlenW (lpString=".rar") returned 4 [0269.705] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString=".bz2") returned 4 [0269.705] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString=".7z") returned 3 [0269.705] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.705] lstrlenW (lpString=".dbf") returned 4 [0269.705] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.705] lstrlenW (lpString=".1cd") returned 4 [0269.705] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.705] lstrlenW (lpString=".jpg") returned 4 [0269.705] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.705] lstrlenW (lpString=".doc") returned 4 [0269.705] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString=".docx") returned 5 [0269.705] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0269.705] lstrlenW (lpString=".pdf") returned 4 [0269.705] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString=".xls") returned 4 [0269.705] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString=".xlsx") returned 5 [0269.705] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0269.705] lstrlenW (lpString=".ppt") returned 4 [0269.705] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.705] lstrlenW (lpString=".zip") returned 4 [0269.706] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.706] lstrlenW (lpString=".rar") returned 4 [0269.706] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.706] lstrlenW (lpString=".bz2") returned 4 [0269.706] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.706] lstrlenW (lpString=".7z") returned 3 [0269.706] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.706] lstrlenW (lpString=".dbf") returned 4 [0269.706] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.706] lstrlenW (lpString=".1cd") returned 4 [0269.706] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0269.706] lstrlenW (lpString=".jpg") returned 4 [0269.706] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.706] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.706] lstrlenW (lpString="VisiorWW.XML") returned 12 [0269.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.707] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=8723) returned 1 [0269.707] CloseHandle (hObject=0x18c) returned 1 [0269.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0269.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.707] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.707] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0269.708] GetLastError () returned 0x0 [0269.708] ReadFile (in: hFile=0x18c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x2213, lpOverlapped=0x0) returned 1 [0269.720] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0269.721] ReadFile (in: hFile=0x18c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.721] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.721] SetEndOfFile (hFile=0x174) returned 1 [0269.721] CloseHandle (hObject=0x174) returned 1 [0269.722] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.722] SetEndOfFile (hFile=0x18c) returned 1 [0269.723] CloseHandle (hObject=0x18c) returned 1 [0269.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.723] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0269.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.724] lstrlenW (lpString=".doc") returned 4 [0269.724] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.724] lstrlenW (lpString=".docx") returned 5 [0269.724] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0269.724] lstrlenW (lpString=".pdf") returned 4 [0269.724] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.724] lstrlenW (lpString=".xls") returned 4 [0269.724] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.724] lstrlenW (lpString=".xlsx") returned 5 [0269.724] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0269.724] lstrlenW (lpString=".ppt") returned 4 [0269.724] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.724] lstrlenW (lpString=".zip") returned 4 [0269.724] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.724] lstrlenW (lpString=".rar") returned 4 [0269.724] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.724] lstrlenW (lpString=".bz2") returned 4 [0269.724] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.724] lstrlenW (lpString=".7z") returned 3 [0269.724] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.724] lstrlenW (lpString=".dbf") returned 4 [0269.724] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.725] lstrlenW (lpString=".1cd") returned 4 [0269.725] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.725] lstrlenW (lpString=".jpg") returned 4 [0269.725] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.725] lstrlenW (lpString=".doc") returned 4 [0269.725] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString=".docx") returned 5 [0269.725] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0269.725] lstrlenW (lpString=".pdf") returned 4 [0269.725] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString=".xls") returned 4 [0269.725] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString=".xlsx") returned 5 [0269.725] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0269.725] lstrlenW (lpString=".ppt") returned 4 [0269.725] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.725] lstrlenW (lpString=".zip") returned 4 [0269.725] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.725] lstrlenW (lpString=".rar") returned 4 [0269.725] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString=".bz2") returned 4 [0269.725] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.725] lstrlenW (lpString=".7z") returned 3 [0269.725] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.725] lstrlenW (lpString=".dbf") returned 4 [0269.725] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.726] lstrlenW (lpString=".1cd") returned 4 [0269.726] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0269.726] lstrlenW (lpString=".jpg") returned 4 [0269.726] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.726] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.726] lstrlenW (lpString="WordMUI.XML") returned 11 [0269.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0269.972] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1800) returned 1 [0269.972] CloseHandle (hObject=0x1f4) returned 1 [0269.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0269.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0269.972] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.972] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0269.973] GetLastError () returned 0x0 [0269.973] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x708, lpOverlapped=0x0) returned 1 [0270.005] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x710, lpOverlapped=0x0) returned 1 [0270.006] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.007] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.007] SetEndOfFile (hFile=0x1e0) returned 1 [0270.369] CloseHandle (hObject=0x1e0) returned 1 [0270.370] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.370] SetEndOfFile (hFile=0x1f4) returned 1 [0270.370] CloseHandle (hObject=0x1f4) returned 1 [0270.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0270.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.371] lstrlenW (lpString=".doc") returned 4 [0270.371] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.371] lstrlenW (lpString=".docx") returned 5 [0270.371] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0270.371] lstrlenW (lpString=".pdf") returned 4 [0270.371] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.371] lstrlenW (lpString=".xls") returned 4 [0270.371] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.371] lstrlenW (lpString=".xlsx") returned 5 [0270.371] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0270.371] lstrlenW (lpString=".ppt") returned 4 [0270.371] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.371] lstrlenW (lpString=".zip") returned 4 [0270.371] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.371] lstrlenW (lpString=".rar") returned 4 [0270.371] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".bz2") returned 4 [0270.372] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".7z") returned 3 [0270.372] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.372] lstrlenW (lpString=".dbf") returned 4 [0270.372] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.372] lstrlenW (lpString=".1cd") returned 4 [0270.372] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.372] lstrlenW (lpString=".jpg") returned 4 [0270.372] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.372] lstrlenW (lpString=".doc") returned 4 [0270.372] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".docx") returned 5 [0270.372] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0270.372] lstrlenW (lpString=".pdf") returned 4 [0270.372] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".xls") returned 4 [0270.372] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".xlsx") returned 5 [0270.372] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0270.372] lstrlenW (lpString=".ppt") returned 4 [0270.372] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.372] lstrlenW (lpString=".zip") returned 4 [0270.372] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.372] lstrlenW (lpString=".rar") returned 4 [0270.372] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".bz2") returned 4 [0270.372] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.372] lstrlenW (lpString=".7z") returned 3 [0270.373] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.373] lstrlenW (lpString=".dbf") returned 4 [0270.373] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.373] lstrlenW (lpString=".1cd") returned 4 [0270.373] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0270.373] lstrlenW (lpString=".jpg") returned 4 [0270.373] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.373] lstrcmpiW (lpString1=".htm", lpString2=".drweb") returned 1 [0270.373] lstrlenW (lpString="Bears.htm") returned 9 [0270.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0270.377] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=255) returned 1 [0270.377] CloseHandle (hObject=0x1f4) returned 1 [0270.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0270.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.378] lstrlenW (lpString=".doc") returned 4 [0270.378] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.378] lstrlenW (lpString=".docx") returned 5 [0270.378] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.378] lstrlenW (lpString=".pdf") returned 4 [0270.378] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.378] lstrlenW (lpString=".xls") returned 4 [0270.378] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.378] lstrlenW (lpString=".xlsx") returned 5 [0270.378] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.378] lstrlenW (lpString=".ppt") returned 4 [0270.378] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.378] lstrlenW (lpString=".zip") returned 4 [0270.378] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.378] lstrlenW (lpString=".rar") returned 4 [0270.378] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.378] lstrlenW (lpString=".bz2") returned 4 [0270.378] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.378] lstrlenW (lpString=".7z") returned 3 [0270.378] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.378] lstrlenW (lpString=".dbf") returned 4 [0270.378] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".1cd") returned 4 [0270.379] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".jpg") returned 4 [0270.379] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".doc") returned 4 [0270.379] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.379] lstrlenW (lpString=".docx") returned 5 [0270.379] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.379] lstrlenW (lpString=".pdf") returned 4 [0270.379] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.379] lstrlenW (lpString=".xls") returned 4 [0270.379] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.379] lstrlenW (lpString=".xlsx") returned 5 [0270.379] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.379] lstrlenW (lpString=".ppt") returned 4 [0270.379] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".zip") returned 4 [0270.379] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.379] lstrlenW (lpString=".rar") returned 4 [0270.379] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.379] lstrlenW (lpString=".bz2") returned 4 [0270.379] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.379] lstrlenW (lpString=".7z") returned 3 [0270.379] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".dbf") returned 4 [0270.379] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".1cd") returned 4 [0270.379] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0270.379] lstrlenW (lpString=".jpg") returned 4 [0270.380] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.380] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.380] lstrlenW (lpString="Bears.jpg") returned 9 [0270.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0270.380] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1074) returned 1 [0270.380] CloseHandle (hObject=0x1f4) returned 1 [0270.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0270.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.380] lstrlenW (lpString=".doc") returned 4 [0270.380] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.380] lstrlenW (lpString=".docx") returned 5 [0270.380] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.380] lstrlenW (lpString=".pdf") returned 4 [0270.380] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.381] lstrlenW (lpString=".xls") returned 4 [0270.381] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.381] lstrlenW (lpString=".xlsx") returned 5 [0270.381] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.381] lstrlenW (lpString=".ppt") returned 4 [0270.381] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.381] lstrlenW (lpString=".zip") returned 4 [0270.381] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.381] lstrlenW (lpString=".rar") returned 4 [0270.381] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.381] lstrlenW (lpString=".bz2") returned 4 [0270.381] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.381] lstrlenW (lpString=".7z") returned 3 [0270.381] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.381] lstrlenW (lpString=".dbf") returned 4 [0270.381] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.381] lstrlenW (lpString=".1cd") returned 4 [0270.381] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.381] lstrlenW (lpString=".jpg") returned 4 [0270.381] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.381] lstrlenW (lpString=".doc") returned 4 [0270.381] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.381] lstrlenW (lpString=".docx") returned 5 [0270.381] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.381] lstrlenW (lpString=".pdf") returned 4 [0270.381] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.381] lstrlenW (lpString=".xls") returned 4 [0270.382] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.382] lstrlenW (lpString=".xlsx") returned 5 [0270.382] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.382] lstrlenW (lpString=".ppt") returned 4 [0270.382] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.382] lstrlenW (lpString=".zip") returned 4 [0270.382] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.382] lstrlenW (lpString=".rar") returned 4 [0270.382] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.382] lstrlenW (lpString=".bz2") returned 4 [0270.382] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.382] lstrlenW (lpString=".7z") returned 3 [0270.382] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.382] lstrlenW (lpString=".dbf") returned 4 [0270.382] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.382] lstrlenW (lpString=".1cd") returned 4 [0270.382] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0270.382] lstrlenW (lpString=".jpg") returned 4 [0270.382] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.382] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.617] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0270.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0271.260] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2575) returned 1 [0271.260] CloseHandle (hObject=0x18c) returned 1 [0271.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0271.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.261] lstrlenW (lpString=".doc") returned 4 [0271.261] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0271.261] lstrlenW (lpString=".docx") returned 5 [0271.261] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0271.261] lstrlenW (lpString=".pdf") returned 4 [0271.261] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0271.261] lstrlenW (lpString=".xls") returned 4 [0271.261] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0271.261] lstrlenW (lpString=".xlsx") returned 5 [0271.261] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0271.261] lstrlenW (lpString=".ppt") returned 4 [0271.261] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0271.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.261] lstrlenW (lpString=".zip") returned 4 [0271.261] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0271.261] lstrlenW (lpString=".rar") returned 4 [0271.261] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0271.261] lstrlenW (lpString=".bz2") returned 4 [0271.262] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0271.262] lstrlenW (lpString=".7z") returned 3 [0271.262] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0271.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.262] lstrlenW (lpString=".dbf") returned 4 [0271.262] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0271.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.262] lstrlenW (lpString=".1cd") returned 4 [0271.262] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0271.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.262] lstrlenW (lpString=".jpg") returned 4 [0271.262] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0271.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.262] lstrlenW (lpString=".doc") returned 4 [0271.262] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0271.262] lstrlenW (lpString=".docx") returned 5 [0271.262] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0271.262] lstrlenW (lpString=".pdf") returned 4 [0271.262] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0271.262] lstrlenW (lpString=".xls") returned 4 [0271.262] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0271.262] lstrlenW (lpString=".xlsx") returned 5 [0271.262] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0271.262] lstrlenW (lpString=".ppt") returned 4 [0271.262] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0271.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.263] lstrlenW (lpString=".zip") returned 4 [0271.263] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0271.263] lstrlenW (lpString=".rar") returned 4 [0271.263] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0271.263] lstrlenW (lpString=".bz2") returned 4 [0271.263] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0271.263] lstrlenW (lpString=".7z") returned 3 [0271.263] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0271.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.263] lstrlenW (lpString=".dbf") returned 4 [0271.263] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0271.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.263] lstrlenW (lpString=".1cd") returned 4 [0271.263] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0271.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0271.263] lstrlenW (lpString=".jpg") returned 4 [0271.263] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0271.263] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0271.263] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0271.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0271.395] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=25234) returned 1 [0271.395] CloseHandle (hObject=0x204) returned 1 [0271.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0271.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0271.395] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.395] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0271.396] GetLastError () returned 0x0 [0271.396] ReadFile (in: hFile=0x204, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x6292, lpOverlapped=0x0) returned 1 [0271.413] WriteFile (in: hFile=0x1e4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0271.415] ReadFile (in: hFile=0x204, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.415] WriteFile (in: hFile=0x1e4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.415] SetEndOfFile (hFile=0x1e4) returned 1 [0271.415] CloseHandle (hObject=0x1e4) returned 1 [0271.416] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.416] SetEndOfFile (hFile=0x204) returned 1 [0271.417] CloseHandle (hObject=0x204) returned 1 [0271.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.418] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0271.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.418] lstrlenW (lpString=".doc") returned 4 [0271.418] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.418] lstrlenW (lpString=".docx") returned 5 [0271.418] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.418] lstrlenW (lpString=".pdf") returned 4 [0271.418] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.418] lstrlenW (lpString=".xls") returned 4 [0271.418] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.418] lstrlenW (lpString=".xlsx") returned 5 [0271.418] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.418] lstrlenW (lpString=".ppt") returned 4 [0271.419] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.419] lstrlenW (lpString=".zip") returned 4 [0271.419] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.419] lstrlenW (lpString=".rar") returned 4 [0271.419] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.419] lstrlenW (lpString=".bz2") returned 4 [0271.419] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.419] lstrlenW (lpString=".7z") returned 3 [0271.419] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.419] lstrlenW (lpString=".dbf") returned 4 [0271.419] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.419] lstrlenW (lpString=".1cd") returned 4 [0271.419] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.419] lstrlenW (lpString=".jpg") returned 4 [0271.419] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.419] lstrlenW (lpString=".doc") returned 4 [0271.419] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.419] lstrlenW (lpString=".docx") returned 5 [0271.419] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.420] lstrlenW (lpString=".pdf") returned 4 [0271.420] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.420] lstrlenW (lpString=".xls") returned 4 [0271.420] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.420] lstrlenW (lpString=".xlsx") returned 5 [0271.420] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.420] lstrlenW (lpString=".ppt") returned 4 [0271.420] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.420] lstrlenW (lpString=".zip") returned 4 [0271.420] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.420] lstrlenW (lpString=".rar") returned 4 [0271.420] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.420] lstrlenW (lpString=".bz2") returned 4 [0271.420] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.420] lstrlenW (lpString=".7z") returned 3 [0271.420] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.420] lstrlenW (lpString=".dbf") returned 4 [0271.420] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.420] lstrlenW (lpString=".1cd") returned 4 [0271.420] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0271.420] lstrlenW (lpString=".jpg") returned 4 [0271.420] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.421] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0271.421] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0271.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0271.655] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=34916) returned 1 [0271.655] CloseHandle (hObject=0x1e4) returned 1 [0271.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0271.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0271.656] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.656] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0271.656] GetLastError () returned 0x0 [0271.656] ReadFile (in: hFile=0x1e4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x8864, lpOverlapped=0x0) returned 1 [0271.688] WriteFile (in: hFile=0x1f0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0271.689] ReadFile (in: hFile=0x1e4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.690] WriteFile (in: hFile=0x1f0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.690] SetEndOfFile (hFile=0x1f0) returned 1 [0271.690] CloseHandle (hObject=0x1f0) returned 1 [0271.690] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.690] SetEndOfFile (hFile=0x1e4) returned 1 [0271.691] CloseHandle (hObject=0x1e4) returned 1 [0271.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0271.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.692] lstrlenW (lpString=".doc") returned 4 [0271.692] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.692] lstrlenW (lpString=".docx") returned 5 [0271.692] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.692] lstrlenW (lpString=".pdf") returned 4 [0271.692] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.692] lstrlenW (lpString=".xls") returned 4 [0271.692] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.692] lstrlenW (lpString=".xlsx") returned 5 [0271.692] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.692] lstrlenW (lpString=".ppt") returned 4 [0271.692] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.693] lstrlenW (lpString=".zip") returned 4 [0271.693] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.693] lstrlenW (lpString=".rar") returned 4 [0271.693] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.693] lstrlenW (lpString=".bz2") returned 4 [0271.693] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.693] lstrlenW (lpString=".7z") returned 3 [0271.693] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.693] lstrlenW (lpString=".dbf") returned 4 [0271.693] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.693] lstrlenW (lpString=".1cd") returned 4 [0271.693] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.693] lstrlenW (lpString=".jpg") returned 4 [0271.693] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.693] lstrlenW (lpString=".doc") returned 4 [0271.693] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.693] lstrlenW (lpString=".docx") returned 5 [0271.693] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.693] lstrlenW (lpString=".pdf") returned 4 [0271.693] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.693] lstrlenW (lpString=".xls") returned 4 [0271.694] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.694] lstrlenW (lpString=".xlsx") returned 5 [0271.694] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.694] lstrlenW (lpString=".ppt") returned 4 [0271.694] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.694] lstrlenW (lpString=".zip") returned 4 [0271.694] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.694] lstrlenW (lpString=".rar") returned 4 [0271.694] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.694] lstrlenW (lpString=".bz2") returned 4 [0271.694] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.694] lstrlenW (lpString=".7z") returned 3 [0271.694] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.694] lstrlenW (lpString=".dbf") returned 4 [0271.694] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.694] lstrlenW (lpString=".1cd") returned 4 [0271.694] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0271.694] lstrlenW (lpString=".jpg") returned 4 [0271.694] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.694] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0271.694] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0271.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0271.862] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2181) returned 1 [0271.862] CloseHandle (hObject=0x1c4) returned 1 [0271.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0271.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0271.862] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.862] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0271.863] GetLastError () returned 0x0 [0271.863] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x885, lpOverlapped=0x0) returned 1 [0271.889] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x890, lpOverlapped=0x0) returned 1 [0271.890] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.890] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.890] SetEndOfFile (hFile=0x204) returned 1 [0271.890] CloseHandle (hObject=0x204) returned 1 [0271.890] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.890] SetEndOfFile (hFile=0x1c4) returned 1 [0271.891] CloseHandle (hObject=0x1c4) returned 1 [0271.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0271.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.891] lstrlenW (lpString=".doc") returned 4 [0271.891] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.891] lstrlenW (lpString=".docx") returned 5 [0271.892] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.892] lstrlenW (lpString=".pdf") returned 4 [0271.892] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.892] lstrlenW (lpString=".xls") returned 4 [0271.892] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.892] lstrlenW (lpString=".xlsx") returned 5 [0271.892] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.892] lstrlenW (lpString=".ppt") returned 4 [0271.892] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.892] lstrlenW (lpString=".zip") returned 4 [0271.892] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.892] lstrlenW (lpString=".rar") returned 4 [0271.892] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.892] lstrlenW (lpString=".bz2") returned 4 [0271.892] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.892] lstrlenW (lpString=".7z") returned 3 [0271.892] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.892] lstrlenW (lpString=".dbf") returned 4 [0271.892] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.892] lstrlenW (lpString=".1cd") returned 4 [0271.892] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.892] lstrlenW (lpString=".jpg") returned 4 [0271.892] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.893] lstrlenW (lpString=".doc") returned 4 [0271.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.893] lstrlenW (lpString=".docx") returned 5 [0271.893] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.893] lstrlenW (lpString=".pdf") returned 4 [0271.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.893] lstrlenW (lpString=".xls") returned 4 [0271.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.893] lstrlenW (lpString=".xlsx") returned 5 [0271.893] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.893] lstrlenW (lpString=".ppt") returned 4 [0271.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.893] lstrlenW (lpString=".zip") returned 4 [0271.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.893] lstrlenW (lpString=".rar") returned 4 [0271.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.893] lstrlenW (lpString=".bz2") returned 4 [0271.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.893] lstrlenW (lpString=".7z") returned 3 [0271.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.893] lstrlenW (lpString=".dbf") returned 4 [0271.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.894] lstrlenW (lpString=".1cd") returned 4 [0271.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0271.894] lstrlenW (lpString=".jpg") returned 4 [0271.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.894] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0271.894] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0271.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0271.894] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1925) returned 1 [0271.894] CloseHandle (hObject=0x1c4) returned 1 [0271.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0271.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0271.895] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.895] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0271.897] GetLastError () returned 0x0 [0271.897] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x785, lpOverlapped=0x0) returned 1 [0272.697] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x790, lpOverlapped=0x0) returned 1 [0273.007] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.007] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.007] SetEndOfFile (hFile=0x204) returned 1 [0273.007] CloseHandle (hObject=0x204) returned 1 [0273.007] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.007] SetEndOfFile (hFile=0x1c4) returned 1 [0273.008] CloseHandle (hObject=0x1c4) returned 1 [0273.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.009] lstrlenW (lpString=".doc") returned 4 [0273.009] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.009] lstrlenW (lpString=".docx") returned 5 [0273.009] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.009] lstrlenW (lpString=".pdf") returned 4 [0273.009] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.009] lstrlenW (lpString=".xls") returned 4 [0273.009] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.009] lstrlenW (lpString=".xlsx") returned 5 [0273.009] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.009] lstrlenW (lpString=".ppt") returned 4 [0273.009] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.009] lstrlenW (lpString=".zip") returned 4 [0273.009] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.009] lstrlenW (lpString=".rar") returned 4 [0273.009] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.009] lstrlenW (lpString=".bz2") returned 4 [0273.010] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.010] lstrlenW (lpString=".7z") returned 3 [0273.010] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.010] lstrlenW (lpString=".dbf") returned 4 [0273.010] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.010] lstrlenW (lpString=".1cd") returned 4 [0273.010] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.010] lstrlenW (lpString=".jpg") returned 4 [0273.010] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.010] lstrlenW (lpString=".doc") returned 4 [0273.010] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.010] lstrlenW (lpString=".docx") returned 5 [0273.010] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.010] lstrlenW (lpString=".pdf") returned 4 [0273.010] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.010] lstrlenW (lpString=".xls") returned 4 [0273.010] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.010] lstrlenW (lpString=".xlsx") returned 5 [0273.010] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.010] lstrlenW (lpString=".ppt") returned 4 [0273.010] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.010] lstrlenW (lpString=".zip") returned 4 [0273.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.011] lstrlenW (lpString=".rar") returned 4 [0273.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.011] lstrlenW (lpString=".bz2") returned 4 [0273.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.011] lstrlenW (lpString=".7z") returned 3 [0273.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.011] lstrlenW (lpString=".dbf") returned 4 [0273.011] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.011] lstrlenW (lpString=".1cd") returned 4 [0273.011] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0273.011] lstrlenW (lpString=".jpg") returned 4 [0273.011] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.011] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0273.011] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0273.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0273.012] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2722) returned 1 [0273.012] CloseHandle (hObject=0x1c4) returned 1 [0273.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0273.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0273.012] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.012] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0273.015] GetLastError () returned 0x0 [0273.015] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0273.287] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0273.288] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.288] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.288] SetEndOfFile (hFile=0x204) returned 1 [0273.288] CloseHandle (hObject=0x204) returned 1 [0273.289] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.289] SetEndOfFile (hFile=0x1c4) returned 1 [0273.290] CloseHandle (hObject=0x1c4) returned 1 [0273.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0273.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.520] lstrlenW (lpString=".doc") returned 4 [0273.520] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.520] lstrlenW (lpString=".docx") returned 5 [0273.521] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.521] lstrlenW (lpString=".pdf") returned 4 [0273.521] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.521] lstrlenW (lpString=".xls") returned 4 [0273.521] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.521] lstrlenW (lpString=".xlsx") returned 5 [0273.521] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.521] lstrlenW (lpString=".ppt") returned 4 [0273.521] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.521] lstrlenW (lpString=".zip") returned 4 [0273.521] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.521] lstrlenW (lpString=".rar") returned 4 [0273.521] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.521] lstrlenW (lpString=".bz2") returned 4 [0273.521] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.521] lstrlenW (lpString=".7z") returned 3 [0273.521] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.521] lstrlenW (lpString=".dbf") returned 4 [0273.521] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.521] lstrlenW (lpString=".1cd") returned 4 [0273.521] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.521] lstrlenW (lpString=".jpg") returned 4 [0273.521] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.521] lstrlenW (lpString=".doc") returned 4 [0273.521] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.521] lstrlenW (lpString=".docx") returned 5 [0273.521] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.521] lstrlenW (lpString=".pdf") returned 4 [0273.522] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.522] lstrlenW (lpString=".xls") returned 4 [0273.522] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.522] lstrlenW (lpString=".xlsx") returned 5 [0273.522] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.522] lstrlenW (lpString=".ppt") returned 4 [0273.522] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.522] lstrlenW (lpString=".zip") returned 4 [0273.522] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.522] lstrlenW (lpString=".rar") returned 4 [0273.522] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.522] lstrlenW (lpString=".bz2") returned 4 [0273.522] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.522] lstrlenW (lpString=".7z") returned 3 [0273.522] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.522] lstrlenW (lpString=".dbf") returned 4 [0273.522] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.522] lstrlenW (lpString=".1cd") returned 4 [0273.522] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0273.522] lstrlenW (lpString=".jpg") returned 4 [0273.522] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.522] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0273.522] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0273.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0273.706] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2044) returned 1 [0273.706] CloseHandle (hObject=0x1e0) returned 1 [0273.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0273.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0273.706] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.706] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0273.744] GetLastError () returned 0x0 [0273.744] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0274.449] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x800, lpOverlapped=0x0) returned 1 [0274.450] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.450] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.450] SetEndOfFile (hFile=0x1c4) returned 1 [0274.450] CloseHandle (hObject=0x1c4) returned 1 [0274.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.450] SetEndOfFile (hFile=0x1e0) returned 1 [0274.451] CloseHandle (hObject=0x1e0) returned 1 [0274.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0274.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.452] lstrlenW (lpString=".doc") returned 4 [0274.452] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.452] lstrlenW (lpString=".docx") returned 5 [0274.452] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.452] lstrlenW (lpString=".pdf") returned 4 [0274.452] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.452] lstrlenW (lpString=".xls") returned 4 [0274.452] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.452] lstrlenW (lpString=".xlsx") returned 5 [0274.452] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.452] lstrlenW (lpString=".ppt") returned 4 [0274.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.452] lstrlenW (lpString=".zip") returned 4 [0274.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.452] lstrlenW (lpString=".rar") returned 4 [0274.452] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.452] lstrlenW (lpString=".bz2") returned 4 [0274.452] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.452] lstrlenW (lpString=".7z") returned 3 [0274.452] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.452] lstrlenW (lpString=".dbf") returned 4 [0274.452] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.452] lstrlenW (lpString=".1cd") returned 4 [0274.452] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString=".jpg") returned 4 [0274.453] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString=".doc") returned 4 [0274.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.453] lstrlenW (lpString=".docx") returned 5 [0274.453] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.453] lstrlenW (lpString=".pdf") returned 4 [0274.453] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.453] lstrlenW (lpString=".xls") returned 4 [0274.453] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.453] lstrlenW (lpString=".xlsx") returned 5 [0274.453] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.453] lstrlenW (lpString=".ppt") returned 4 [0274.453] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString=".zip") returned 4 [0274.453] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.453] lstrlenW (lpString=".rar") returned 4 [0274.453] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.453] lstrlenW (lpString=".bz2") returned 4 [0274.453] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.453] lstrlenW (lpString=".7z") returned 3 [0274.453] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString=".dbf") returned 4 [0274.453] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString=".1cd") returned 4 [0274.453] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0274.453] lstrlenW (lpString=".jpg") returned 4 [0274.453] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.454] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0274.454] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0274.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0274.454] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=3957) returned 1 [0274.454] CloseHandle (hObject=0x1e0) returned 1 [0274.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0274.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0274.454] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.455] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0274.593] GetLastError () returned 0x0 [0274.594] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xf75, lpOverlapped=0x0) returned 1 [0274.736] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0274.737] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.737] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.737] SetEndOfFile (hFile=0x174) returned 1 [0274.737] CloseHandle (hObject=0x174) returned 1 [0274.738] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.738] SetEndOfFile (hFile=0x1e0) returned 1 [0274.738] CloseHandle (hObject=0x1e0) returned 1 [0274.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.739] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0274.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.739] lstrlenW (lpString=".doc") returned 4 [0274.739] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.739] lstrlenW (lpString=".docx") returned 5 [0274.739] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.739] lstrlenW (lpString=".pdf") returned 4 [0274.739] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.739] lstrlenW (lpString=".xls") returned 4 [0274.739] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.739] lstrlenW (lpString=".xlsx") returned 5 [0274.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.739] lstrlenW (lpString=".ppt") returned 4 [0274.739] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.739] lstrlenW (lpString=".zip") returned 4 [0274.739] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.739] lstrlenW (lpString=".rar") returned 4 [0274.739] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.739] lstrlenW (lpString=".bz2") returned 4 [0274.739] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.739] lstrlenW (lpString=".7z") returned 3 [0274.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.739] lstrlenW (lpString=".dbf") returned 4 [0274.740] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.740] lstrlenW (lpString=".1cd") returned 4 [0274.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.740] lstrlenW (lpString=".jpg") returned 4 [0274.740] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.740] lstrlenW (lpString=".doc") returned 4 [0274.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.740] lstrlenW (lpString=".docx") returned 5 [0274.740] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.740] lstrlenW (lpString=".pdf") returned 4 [0274.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.740] lstrlenW (lpString=".xls") returned 4 [0274.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.740] lstrlenW (lpString=".xlsx") returned 5 [0274.740] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.740] lstrlenW (lpString=".ppt") returned 4 [0274.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.740] lstrlenW (lpString=".zip") returned 4 [0274.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.740] lstrlenW (lpString=".rar") returned 4 [0274.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.740] lstrlenW (lpString=".bz2") returned 4 [0274.740] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.740] lstrlenW (lpString=".7z") returned 3 [0274.740] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.741] lstrlenW (lpString=".dbf") returned 4 [0274.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.741] lstrlenW (lpString=".1cd") returned 4 [0274.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0274.741] lstrlenW (lpString=".jpg") returned 4 [0274.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.741] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0274.741] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0274.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0274.741] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1347) returned 1 [0274.741] CloseHandle (hObject=0x1e0) returned 1 [0274.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0274.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0274.742] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.742] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0275.141] GetLastError () returned 0x0 [0275.141] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x543, lpOverlapped=0x0) returned 1 [0275.331] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x550, lpOverlapped=0x0) returned 1 [0275.334] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.334] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0275.334] SetEndOfFile (hFile=0x174) returned 1 [0275.334] CloseHandle (hObject=0x174) returned 1 [0275.334] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.334] SetEndOfFile (hFile=0x1e0) returned 1 [0275.335] CloseHandle (hObject=0x1e0) returned 1 [0275.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.336] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0275.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.336] lstrlenW (lpString=".doc") returned 4 [0275.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.336] lstrlenW (lpString=".docx") returned 5 [0275.336] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.336] lstrlenW (lpString=".pdf") returned 4 [0275.336] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.336] lstrlenW (lpString=".xls") returned 4 [0275.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.336] lstrlenW (lpString=".xlsx") returned 5 [0275.336] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.336] lstrlenW (lpString=".ppt") returned 4 [0275.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.336] lstrlenW (lpString=".zip") returned 4 [0275.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.336] lstrlenW (lpString=".rar") returned 4 [0275.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.337] lstrlenW (lpString=".bz2") returned 4 [0275.337] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.337] lstrlenW (lpString=".7z") returned 3 [0275.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.337] lstrlenW (lpString=".dbf") returned 4 [0275.337] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.337] lstrlenW (lpString=".1cd") returned 4 [0275.337] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.337] lstrlenW (lpString=".jpg") returned 4 [0275.337] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.337] lstrlenW (lpString=".doc") returned 4 [0275.337] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.337] lstrlenW (lpString=".docx") returned 5 [0275.337] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.337] lstrlenW (lpString=".pdf") returned 4 [0275.337] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.337] lstrlenW (lpString=".xls") returned 4 [0275.337] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.337] lstrlenW (lpString=".xlsx") returned 5 [0275.337] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.337] lstrlenW (lpString=".ppt") returned 4 [0275.337] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.338] lstrlenW (lpString=".zip") returned 4 [0275.338] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.338] lstrlenW (lpString=".rar") returned 4 [0275.338] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.338] lstrlenW (lpString=".bz2") returned 4 [0275.338] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.338] lstrlenW (lpString=".7z") returned 3 [0275.338] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.338] lstrlenW (lpString=".dbf") returned 4 [0275.338] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.338] lstrlenW (lpString=".1cd") returned 4 [0275.338] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0275.338] lstrlenW (lpString=".jpg") returned 4 [0275.338] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.338] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0275.338] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0275.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0275.339] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=5120) returned 1 [0275.339] CloseHandle (hObject=0x1e0) returned 1 [0275.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0275.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0275.339] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.339] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0275.627] GetLastError () returned 0x0 [0275.627] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x1400, lpOverlapped=0x0) returned 1 [0275.778] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0275.779] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.779] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0275.779] SetEndOfFile (hFile=0x204) returned 1 [0275.780] CloseHandle (hObject=0x204) returned 1 [0275.780] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.780] SetEndOfFile (hFile=0x1e0) returned 1 [0275.781] CloseHandle (hObject=0x1e0) returned 1 [0275.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.781] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0275.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.782] lstrlenW (lpString=".doc") returned 4 [0275.782] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.782] lstrlenW (lpString=".docx") returned 5 [0275.782] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.782] lstrlenW (lpString=".pdf") returned 4 [0275.782] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.782] lstrlenW (lpString=".xls") returned 4 [0275.782] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.782] lstrlenW (lpString=".xlsx") returned 5 [0275.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.782] lstrlenW (lpString=".ppt") returned 4 [0275.782] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.782] lstrlenW (lpString=".zip") returned 4 [0275.782] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.782] lstrlenW (lpString=".rar") returned 4 [0275.782] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.782] lstrlenW (lpString=".bz2") returned 4 [0275.782] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.782] lstrlenW (lpString=".7z") returned 3 [0275.782] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.782] lstrlenW (lpString=".dbf") returned 4 [0275.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.782] lstrlenW (lpString=".1cd") returned 4 [0275.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.783] lstrlenW (lpString=".jpg") returned 4 [0275.783] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.783] lstrlenW (lpString=".doc") returned 4 [0275.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.783] lstrlenW (lpString=".docx") returned 5 [0275.783] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.783] lstrlenW (lpString=".pdf") returned 4 [0275.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.783] lstrlenW (lpString=".xls") returned 4 [0275.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.783] lstrlenW (lpString=".xlsx") returned 5 [0275.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.783] lstrlenW (lpString=".ppt") returned 4 [0275.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.783] lstrlenW (lpString=".zip") returned 4 [0275.783] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.783] lstrlenW (lpString=".rar") returned 4 [0275.783] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.783] lstrlenW (lpString=".bz2") returned 4 [0275.783] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.783] lstrlenW (lpString=".7z") returned 3 [0275.783] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.783] lstrlenW (lpString=".dbf") returned 4 [0275.783] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.783] lstrlenW (lpString=".1cd") returned 4 [0275.783] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0275.784] lstrlenW (lpString=".jpg") returned 4 [0275.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.784] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0275.784] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0275.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0275.784] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=5179) returned 1 [0275.784] CloseHandle (hObject=0x1e0) returned 1 [0275.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0275.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0275.785] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.785] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0276.051] GetLastError () returned 0x0 [0276.051] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x143b, lpOverlapped=0x0) returned 1 [0277.752] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0278.029] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.029] WriteFile (in: hFile=0x204, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.029] SetEndOfFile (hFile=0x204) returned 1 [0278.029] CloseHandle (hObject=0x204) returned 1 [0278.029] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.029] SetEndOfFile (hFile=0x1e0) returned 1 [0278.030] CloseHandle (hObject=0x1e0) returned 1 [0278.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.030] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0278.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.031] lstrlenW (lpString=".doc") returned 4 [0278.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.031] lstrlenW (lpString=".docx") returned 5 [0278.031] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.031] lstrlenW (lpString=".pdf") returned 4 [0278.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.031] lstrlenW (lpString=".xls") returned 4 [0278.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.031] lstrlenW (lpString=".xlsx") returned 5 [0278.031] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.031] lstrlenW (lpString=".ppt") returned 4 [0278.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.031] lstrlenW (lpString=".zip") returned 4 [0278.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.031] lstrlenW (lpString=".rar") returned 4 [0278.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.031] lstrlenW (lpString=".bz2") returned 4 [0278.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.031] lstrlenW (lpString=".7z") returned 3 [0278.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.032] lstrlenW (lpString=".dbf") returned 4 [0278.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.032] lstrlenW (lpString=".1cd") returned 4 [0278.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.032] lstrlenW (lpString=".jpg") returned 4 [0278.032] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.032] lstrlenW (lpString=".doc") returned 4 [0278.032] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.032] lstrlenW (lpString=".docx") returned 5 [0278.032] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.032] lstrlenW (lpString=".pdf") returned 4 [0278.032] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.032] lstrlenW (lpString=".xls") returned 4 [0278.032] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.032] lstrlenW (lpString=".xlsx") returned 5 [0278.032] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.032] lstrlenW (lpString=".ppt") returned 4 [0278.032] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.032] lstrlenW (lpString=".zip") returned 4 [0278.032] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.032] lstrlenW (lpString=".rar") returned 4 [0278.032] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.032] lstrlenW (lpString=".bz2") returned 4 [0278.032] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.033] lstrlenW (lpString=".7z") returned 3 [0278.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.033] lstrlenW (lpString=".dbf") returned 4 [0278.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.033] lstrlenW (lpString=".1cd") returned 4 [0278.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0278.033] lstrlenW (lpString=".jpg") returned 4 [0278.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.033] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0278.033] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0278.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.034] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1659) returned 1 [0278.034] CloseHandle (hObject=0x1e0) returned 1 [0278.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0278.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.034] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.034] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0278.399] GetLastError () returned 0x0 [0278.399] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x67b, lpOverlapped=0x0) returned 1 [0278.413] WriteFile (in: hFile=0x20c, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x680, lpOverlapped=0x0) returned 1 [0278.416] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.416] WriteFile (in: hFile=0x20c, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.416] SetEndOfFile (hFile=0x20c) returned 1 [0278.416] CloseHandle (hObject=0x20c) returned 1 [0278.417] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.417] SetEndOfFile (hFile=0x1e0) returned 1 [0278.418] CloseHandle (hObject=0x1e0) returned 1 [0278.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.418] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0278.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.419] lstrlenW (lpString=".doc") returned 4 [0278.419] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.419] lstrlenW (lpString=".docx") returned 5 [0278.419] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.419] lstrlenW (lpString=".pdf") returned 4 [0278.419] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.419] lstrlenW (lpString=".xls") returned 4 [0278.419] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.419] lstrlenW (lpString=".xlsx") returned 5 [0278.419] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.419] lstrlenW (lpString=".ppt") returned 4 [0278.419] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.419] lstrlenW (lpString=".zip") returned 4 [0278.419] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.419] lstrlenW (lpString=".rar") returned 4 [0278.419] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.419] lstrlenW (lpString=".bz2") returned 4 [0278.419] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.419] lstrlenW (lpString=".7z") returned 3 [0278.419] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.419] lstrlenW (lpString=".dbf") returned 4 [0278.419] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.420] lstrlenW (lpString=".1cd") returned 4 [0278.420] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.420] lstrlenW (lpString=".jpg") returned 4 [0278.420] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.420] lstrlenW (lpString=".doc") returned 4 [0278.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.420] lstrlenW (lpString=".docx") returned 5 [0278.420] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.420] lstrlenW (lpString=".pdf") returned 4 [0278.420] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.420] lstrlenW (lpString=".xls") returned 4 [0278.420] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.420] lstrlenW (lpString=".xlsx") returned 5 [0278.420] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.420] lstrlenW (lpString=".ppt") returned 4 [0278.420] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.420] lstrlenW (lpString=".zip") returned 4 [0278.420] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.420] lstrlenW (lpString=".rar") returned 4 [0278.420] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.420] lstrlenW (lpString=".bz2") returned 4 [0278.420] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.420] lstrlenW (lpString=".7z") returned 3 [0278.420] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.421] lstrlenW (lpString=".dbf") returned 4 [0278.421] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.421] lstrlenW (lpString=".1cd") returned 4 [0278.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0278.421] lstrlenW (lpString=".jpg") returned 4 [0278.421] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.421] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0278.421] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0278.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.422] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1364) returned 1 [0278.422] CloseHandle (hObject=0x1e0) returned 1 [0278.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0278.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.423] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.423] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.450] GetLastError () returned 0x0 [0278.450] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x554, lpOverlapped=0x0) returned 1 [0278.452] WriteFile (in: hFile=0x1c0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x560, lpOverlapped=0x0) returned 1 [0278.453] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.453] WriteFile (in: hFile=0x1c0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.453] SetEndOfFile (hFile=0x1c0) returned 1 [0278.453] CloseHandle (hObject=0x1c0) returned 1 [0278.453] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.454] SetEndOfFile (hFile=0x1e0) returned 1 [0278.454] CloseHandle (hObject=0x1e0) returned 1 [0278.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.455] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0278.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.455] lstrlenW (lpString=".doc") returned 4 [0278.455] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.455] lstrlenW (lpString=".docx") returned 5 [0278.455] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.455] lstrlenW (lpString=".pdf") returned 4 [0278.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.455] lstrlenW (lpString=".xls") returned 4 [0278.455] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.456] lstrlenW (lpString=".xlsx") returned 5 [0278.456] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.456] lstrlenW (lpString=".ppt") returned 4 [0278.456] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.456] lstrlenW (lpString=".zip") returned 4 [0278.456] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.456] lstrlenW (lpString=".rar") returned 4 [0278.456] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.456] lstrlenW (lpString=".bz2") returned 4 [0278.456] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.456] lstrlenW (lpString=".7z") returned 3 [0278.456] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.456] lstrlenW (lpString=".dbf") returned 4 [0278.456] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.456] lstrlenW (lpString=".1cd") returned 4 [0278.456] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.456] lstrlenW (lpString=".jpg") returned 4 [0278.456] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.457] lstrlenW (lpString=".doc") returned 4 [0278.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.457] lstrlenW (lpString=".docx") returned 5 [0278.457] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.457] lstrlenW (lpString=".pdf") returned 4 [0278.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.457] lstrlenW (lpString=".xls") returned 4 [0278.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.457] lstrlenW (lpString=".xlsx") returned 5 [0278.457] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.457] lstrlenW (lpString=".ppt") returned 4 [0278.457] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.457] lstrlenW (lpString=".zip") returned 4 [0278.457] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.457] lstrlenW (lpString=".rar") returned 4 [0278.457] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.457] lstrlenW (lpString=".bz2") returned 4 [0278.457] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.457] lstrlenW (lpString=".7z") returned 3 [0278.457] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.457] lstrlenW (lpString=".dbf") returned 4 [0278.457] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.458] lstrlenW (lpString=".1cd") returned 4 [0278.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0278.458] lstrlenW (lpString=".jpg") returned 4 [0278.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.458] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0278.458] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0278.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.458] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=11573) returned 1 [0278.459] CloseHandle (hObject=0x1e0) returned 1 [0278.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0278.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.459] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.459] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.460] GetLastError () returned 0x0 [0278.460] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0278.496] WriteFile (in: hFile=0x1c0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0278.501] ReadFile (in: hFile=0x1e0, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.501] WriteFile (in: hFile=0x1c0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.501] SetEndOfFile (hFile=0x1c0) returned 1 [0278.502] CloseHandle (hObject=0x1c0) returned 1 [0278.502] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.502] SetEndOfFile (hFile=0x1e0) returned 1 [0278.503] CloseHandle (hObject=0x1e0) returned 1 [0278.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0278.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.504] lstrlenW (lpString=".doc") returned 4 [0278.504] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.504] lstrlenW (lpString=".docx") returned 5 [0278.504] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.504] lstrlenW (lpString=".pdf") returned 4 [0278.504] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.504] lstrlenW (lpString=".xls") returned 4 [0278.504] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.504] lstrlenW (lpString=".xlsx") returned 5 [0278.505] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.505] lstrlenW (lpString=".ppt") returned 4 [0278.505] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.505] lstrlenW (lpString=".zip") returned 4 [0278.505] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.505] lstrlenW (lpString=".rar") returned 4 [0278.505] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.505] lstrlenW (lpString=".bz2") returned 4 [0278.505] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.505] lstrlenW (lpString=".7z") returned 3 [0278.505] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.505] lstrlenW (lpString=".dbf") returned 4 [0278.505] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.505] lstrlenW (lpString=".1cd") returned 4 [0278.505] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.505] lstrlenW (lpString=".jpg") returned 4 [0278.505] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.505] lstrlenW (lpString=".doc") returned 4 [0278.505] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.506] lstrlenW (lpString=".docx") returned 5 [0278.506] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.506] lstrlenW (lpString=".pdf") returned 4 [0278.506] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.506] lstrlenW (lpString=".xls") returned 4 [0278.506] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.506] lstrlenW (lpString=".xlsx") returned 5 [0278.506] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.506] lstrlenW (lpString=".ppt") returned 4 [0278.506] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.506] lstrlenW (lpString=".zip") returned 4 [0278.506] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.506] lstrlenW (lpString=".rar") returned 4 [0278.506] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.506] lstrlenW (lpString=".bz2") returned 4 [0278.506] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.506] lstrlenW (lpString=".7z") returned 3 [0278.506] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.507] lstrlenW (lpString=".dbf") returned 4 [0278.507] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.507] lstrlenW (lpString=".1cd") returned 4 [0278.507] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0278.507] lstrlenW (lpString=".jpg") returned 4 [0278.507] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.507] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0278.507] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0278.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0279.298] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=37440) returned 1 [0279.298] CloseHandle (hObject=0x1c4) returned 1 [0279.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0279.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0279.299] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.299] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0279.300] GetLastError () returned 0x0 [0279.300] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x9240, lpOverlapped=0x0) returned 1 [0279.427] WriteFile (in: hFile=0x1f4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0279.429] ReadFile (in: hFile=0x1c4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.429] WriteFile (in: hFile=0x1f4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.430] SetEndOfFile (hFile=0x1f4) returned 1 [0279.430] CloseHandle (hObject=0x1f4) returned 1 [0279.430] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.430] SetEndOfFile (hFile=0x1c4) returned 1 [0279.432] CloseHandle (hObject=0x1c4) returned 1 [0279.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0279.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.441] lstrlenW (lpString=".doc") returned 4 [0279.441] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.441] lstrlenW (lpString=".docx") returned 5 [0279.441] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.441] lstrlenW (lpString=".pdf") returned 4 [0279.441] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.441] lstrlenW (lpString=".xls") returned 4 [0279.441] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.441] lstrlenW (lpString=".xlsx") returned 5 [0279.441] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.442] lstrlenW (lpString=".ppt") returned 4 [0279.442] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.442] lstrlenW (lpString=".zip") returned 4 [0279.442] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.442] lstrlenW (lpString=".rar") returned 4 [0279.442] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.442] lstrlenW (lpString=".bz2") returned 4 [0279.442] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.442] lstrlenW (lpString=".7z") returned 3 [0279.442] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.442] lstrlenW (lpString=".dbf") returned 4 [0279.442] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.442] lstrlenW (lpString=".1cd") returned 4 [0279.442] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.442] lstrlenW (lpString=".jpg") returned 4 [0279.442] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.442] lstrlenW (lpString=".doc") returned 4 [0279.442] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.442] lstrlenW (lpString=".docx") returned 5 [0279.442] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.442] lstrlenW (lpString=".pdf") returned 4 [0279.443] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.443] lstrlenW (lpString=".xls") returned 4 [0279.443] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.443] lstrlenW (lpString=".xlsx") returned 5 [0279.443] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.443] lstrlenW (lpString=".ppt") returned 4 [0279.443] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.443] lstrlenW (lpString=".zip") returned 4 [0279.443] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.443] lstrlenW (lpString=".rar") returned 4 [0279.443] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.443] lstrlenW (lpString=".bz2") returned 4 [0279.443] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.443] lstrlenW (lpString=".7z") returned 3 [0279.443] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.444] lstrlenW (lpString=".dbf") returned 4 [0279.444] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.444] lstrlenW (lpString=".1cd") returned 4 [0279.444] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0279.444] lstrlenW (lpString=".jpg") returned 4 [0279.444] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.444] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0279.444] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0279.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.717] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=31975) returned 1 [0279.718] CloseHandle (hObject=0x214) returned 1 [0279.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0279.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.718] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.718] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0279.719] GetLastError () returned 0x0 [0279.719] ReadFile (in: hFile=0x214, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0280.184] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0280.185] ReadFile (in: hFile=0x214, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.185] WriteFile (in: hFile=0x174, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0280.185] SetEndOfFile (hFile=0x174) returned 1 [0280.185] CloseHandle (hObject=0x174) returned 1 [0280.186] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.186] SetEndOfFile (hFile=0x214) returned 1 [0280.187] CloseHandle (hObject=0x214) returned 1 [0280.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0280.187] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0280.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.187] lstrlenW (lpString=".doc") returned 4 [0280.187] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0280.187] lstrlenW (lpString=".docx") returned 5 [0280.187] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0280.188] lstrlenW (lpString=".pdf") returned 4 [0280.188] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0280.188] lstrlenW (lpString=".xls") returned 4 [0280.188] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0280.188] lstrlenW (lpString=".xlsx") returned 5 [0280.188] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0280.188] lstrlenW (lpString=".ppt") returned 4 [0280.188] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0280.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.188] lstrlenW (lpString=".zip") returned 4 [0280.188] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0280.188] lstrlenW (lpString=".rar") returned 4 [0280.188] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0280.188] lstrlenW (lpString=".bz2") returned 4 [0280.188] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0280.188] lstrlenW (lpString=".7z") returned 3 [0280.188] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0280.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.188] lstrlenW (lpString=".dbf") returned 4 [0280.188] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0280.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.188] lstrlenW (lpString=".1cd") returned 4 [0280.188] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0280.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.188] lstrlenW (lpString=".jpg") returned 4 [0280.188] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0280.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.189] lstrlenW (lpString=".doc") returned 4 [0280.189] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0280.189] lstrlenW (lpString=".docx") returned 5 [0280.189] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0280.189] lstrlenW (lpString=".pdf") returned 4 [0280.189] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0280.189] lstrlenW (lpString=".xls") returned 4 [0280.189] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0280.189] lstrlenW (lpString=".xlsx") returned 5 [0280.189] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0280.189] lstrlenW (lpString=".ppt") returned 4 [0280.189] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0280.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.189] lstrlenW (lpString=".zip") returned 4 [0280.189] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0280.189] lstrlenW (lpString=".rar") returned 4 [0280.189] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0280.189] lstrlenW (lpString=".bz2") returned 4 [0280.189] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0280.189] lstrlenW (lpString=".7z") returned 3 [0280.189] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0280.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.189] lstrlenW (lpString=".dbf") returned 4 [0280.189] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0280.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.189] lstrlenW (lpString=".1cd") returned 4 [0280.189] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0280.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0280.189] lstrlenW (lpString=".jpg") returned 4 [0280.190] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0280.190] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0280.190] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0280.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0280.395] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=29305) returned 1 [0280.395] CloseHandle (hObject=0x218) returned 1 [0280.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0280.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0280.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0280.396] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.396] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0280.396] GetLastError () returned 0x0 [0280.396] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x7279, lpOverlapped=0x0) returned 1 [0281.405] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0281.407] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.407] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.407] SetEndOfFile (hFile=0x1c4) returned 1 [0281.407] CloseHandle (hObject=0x1c4) returned 1 [0281.407] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.407] SetEndOfFile (hFile=0x218) returned 1 [0281.408] CloseHandle (hObject=0x218) returned 1 [0281.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.409] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0281.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.409] lstrlenW (lpString=".doc") returned 4 [0281.409] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.409] lstrlenW (lpString=".docx") returned 5 [0281.409] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.409] lstrlenW (lpString=".pdf") returned 4 [0281.409] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.409] lstrlenW (lpString=".xls") returned 4 [0281.409] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.409] lstrlenW (lpString=".xlsx") returned 5 [0281.409] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.409] lstrlenW (lpString=".ppt") returned 4 [0281.409] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.410] lstrlenW (lpString=".zip") returned 4 [0281.410] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.410] lstrlenW (lpString=".rar") returned 4 [0281.410] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.410] lstrlenW (lpString=".bz2") returned 4 [0281.410] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.410] lstrlenW (lpString=".7z") returned 3 [0281.410] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.410] lstrlenW (lpString=".dbf") returned 4 [0281.410] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.410] lstrlenW (lpString=".1cd") returned 4 [0281.410] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.410] lstrlenW (lpString=".jpg") returned 4 [0281.410] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.410] lstrlenW (lpString=".doc") returned 4 [0281.410] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.410] lstrlenW (lpString=".docx") returned 5 [0281.410] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.410] lstrlenW (lpString=".pdf") returned 4 [0281.410] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.411] lstrlenW (lpString=".xls") returned 4 [0281.411] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.411] lstrlenW (lpString=".xlsx") returned 5 [0281.411] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.411] lstrlenW (lpString=".ppt") returned 4 [0281.411] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.411] lstrlenW (lpString=".zip") returned 4 [0281.411] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.411] lstrlenW (lpString=".rar") returned 4 [0281.411] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.411] lstrlenW (lpString=".bz2") returned 4 [0281.411] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.411] lstrlenW (lpString=".7z") returned 3 [0281.411] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.411] lstrlenW (lpString=".dbf") returned 4 [0281.411] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.411] lstrlenW (lpString=".1cd") returned 4 [0281.411] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0281.411] lstrlenW (lpString=".jpg") returned 4 [0281.411] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.412] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0281.412] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0281.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0281.423] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2209) returned 1 [0281.423] CloseHandle (hObject=0x1f4) returned 1 [0281.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0281.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0281.424] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.424] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.427] GetLastError () returned 0x0 [0281.427] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0281.442] WriteFile (in: hFile=0x218, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0281.443] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.443] WriteFile (in: hFile=0x218, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.443] SetEndOfFile (hFile=0x218) returned 1 [0281.443] CloseHandle (hObject=0x218) returned 1 [0281.443] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.443] SetEndOfFile (hFile=0x1f4) returned 1 [0281.444] CloseHandle (hObject=0x1f4) returned 1 [0281.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.445] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0281.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.445] lstrlenW (lpString=".doc") returned 4 [0281.445] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.445] lstrlenW (lpString=".docx") returned 5 [0281.445] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.445] lstrlenW (lpString=".pdf") returned 4 [0281.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.446] lstrlenW (lpString=".xls") returned 4 [0281.446] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.446] lstrlenW (lpString=".xlsx") returned 5 [0281.446] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.446] lstrlenW (lpString=".ppt") returned 4 [0281.446] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.446] lstrlenW (lpString=".zip") returned 4 [0281.446] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.446] lstrlenW (lpString=".rar") returned 4 [0281.446] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.446] lstrlenW (lpString=".bz2") returned 4 [0281.446] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.446] lstrlenW (lpString=".7z") returned 3 [0281.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.446] lstrlenW (lpString=".dbf") returned 4 [0281.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.446] lstrlenW (lpString=".1cd") returned 4 [0281.446] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.446] lstrlenW (lpString=".jpg") returned 4 [0281.446] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.446] lstrlenW (lpString=".doc") returned 4 [0281.447] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.447] lstrlenW (lpString=".docx") returned 5 [0281.447] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.447] lstrlenW (lpString=".pdf") returned 4 [0281.447] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.447] lstrlenW (lpString=".xls") returned 4 [0281.447] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.447] lstrlenW (lpString=".xlsx") returned 5 [0281.447] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.447] lstrlenW (lpString=".ppt") returned 4 [0281.447] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.447] lstrlenW (lpString=".zip") returned 4 [0281.447] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.447] lstrlenW (lpString=".rar") returned 4 [0281.447] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.447] lstrlenW (lpString=".bz2") returned 4 [0281.447] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.447] lstrlenW (lpString=".7z") returned 3 [0281.447] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.447] lstrlenW (lpString=".dbf") returned 4 [0281.447] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.447] lstrlenW (lpString=".1cd") returned 4 [0281.447] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0281.447] lstrlenW (lpString=".jpg") returned 4 [0281.448] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.448] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0281.448] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0281.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0281.448] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2527) returned 1 [0281.448] CloseHandle (hObject=0x1f4) returned 1 [0281.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0281.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0281.449] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.449] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.451] GetLastError () returned 0x0 [0281.451] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x9df, lpOverlapped=0x0) returned 1 [0281.476] WriteFile (in: hFile=0x218, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0281.477] ReadFile (in: hFile=0x1f4, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.477] WriteFile (in: hFile=0x218, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.477] SetEndOfFile (hFile=0x218) returned 1 [0281.477] CloseHandle (hObject=0x218) returned 1 [0281.478] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.478] SetEndOfFile (hFile=0x1f4) returned 1 [0281.479] CloseHandle (hObject=0x1f4) returned 1 [0281.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0281.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.488] lstrlenW (lpString=".doc") returned 4 [0281.488] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.488] lstrlenW (lpString=".docx") returned 5 [0281.488] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.488] lstrlenW (lpString=".pdf") returned 4 [0281.488] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.488] lstrlenW (lpString=".xls") returned 4 [0281.488] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.488] lstrlenW (lpString=".xlsx") returned 5 [0281.488] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.488] lstrlenW (lpString=".ppt") returned 4 [0281.488] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.488] lstrlenW (lpString=".zip") returned 4 [0281.488] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.488] lstrlenW (lpString=".rar") returned 4 [0281.488] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.488] lstrlenW (lpString=".bz2") returned 4 [0281.488] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.488] lstrlenW (lpString=".7z") returned 3 [0281.488] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.488] lstrlenW (lpString=".dbf") returned 4 [0281.488] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.488] lstrlenW (lpString=".1cd") returned 4 [0281.488] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.489] lstrlenW (lpString=".jpg") returned 4 [0281.489] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.489] lstrlenW (lpString=".doc") returned 4 [0281.489] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.489] lstrlenW (lpString=".docx") returned 5 [0281.489] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.489] lstrlenW (lpString=".pdf") returned 4 [0281.489] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.489] lstrlenW (lpString=".xls") returned 4 [0281.489] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.489] lstrlenW (lpString=".xlsx") returned 5 [0281.489] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.489] lstrlenW (lpString=".ppt") returned 4 [0281.489] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.489] lstrlenW (lpString=".zip") returned 4 [0281.489] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.489] lstrlenW (lpString=".rar") returned 4 [0281.489] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.489] lstrlenW (lpString=".bz2") returned 4 [0281.489] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.489] lstrlenW (lpString=".7z") returned 3 [0281.489] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.490] lstrlenW (lpString=".dbf") returned 4 [0281.490] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.490] lstrlenW (lpString=".1cd") returned 4 [0281.490] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0281.490] lstrlenW (lpString=".jpg") returned 4 [0281.490] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.490] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0281.490] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0281.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.494] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=33479) returned 1 [0281.494] CloseHandle (hObject=0x218) returned 1 [0281.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0281.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.494] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.494] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0281.495] GetLastError () returned 0x0 [0281.495] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0281.551] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0281.552] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.552] WriteFile (in: hFile=0x1c4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.553] SetEndOfFile (hFile=0x1c4) returned 1 [0281.553] CloseHandle (hObject=0x1c4) returned 1 [0281.553] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.553] SetEndOfFile (hFile=0x218) returned 1 [0281.554] CloseHandle (hObject=0x218) returned 1 [0281.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.555] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0281.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.555] lstrlenW (lpString=".doc") returned 4 [0281.555] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.555] lstrlenW (lpString=".docx") returned 5 [0281.555] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.555] lstrlenW (lpString=".pdf") returned 4 [0281.555] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.555] lstrlenW (lpString=".xls") returned 4 [0281.555] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.555] lstrlenW (lpString=".xlsx") returned 5 [0281.556] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.556] lstrlenW (lpString=".ppt") returned 4 [0281.556] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.556] lstrlenW (lpString=".zip") returned 4 [0281.556] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.556] lstrlenW (lpString=".rar") returned 4 [0281.556] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.556] lstrlenW (lpString=".bz2") returned 4 [0281.556] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.556] lstrlenW (lpString=".7z") returned 3 [0281.556] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.556] lstrlenW (lpString=".dbf") returned 4 [0281.556] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.556] lstrlenW (lpString=".1cd") returned 4 [0281.556] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.556] lstrlenW (lpString=".jpg") returned 4 [0281.556] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.556] lstrlenW (lpString=".doc") returned 4 [0281.556] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.557] lstrlenW (lpString=".docx") returned 5 [0281.557] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.557] lstrlenW (lpString=".pdf") returned 4 [0281.557] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.557] lstrlenW (lpString=".xls") returned 4 [0281.557] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.557] lstrlenW (lpString=".xlsx") returned 5 [0281.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.557] lstrlenW (lpString=".ppt") returned 4 [0281.557] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.557] lstrlenW (lpString=".zip") returned 4 [0281.557] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.557] lstrlenW (lpString=".rar") returned 4 [0281.557] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.557] lstrlenW (lpString=".bz2") returned 4 [0281.557] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.557] lstrlenW (lpString=".7z") returned 3 [0281.557] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.557] lstrlenW (lpString=".dbf") returned 4 [0281.557] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.557] lstrlenW (lpString=".1cd") returned 4 [0281.557] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0281.557] lstrlenW (lpString=".jpg") returned 4 [0281.557] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.558] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0281.558] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0281.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.558] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=1675) returned 1 [0281.558] CloseHandle (hObject=0x218) returned 1 [0281.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0281.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.561] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.561] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0281.794] GetLastError () returned 0x0 [0281.794] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x68b, lpOverlapped=0x0) returned 1 [0281.900] WriteFile (in: hFile=0x214, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x690, lpOverlapped=0x0) returned 1 [0281.949] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.949] WriteFile (in: hFile=0x214, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.949] SetEndOfFile (hFile=0x214) returned 1 [0281.949] CloseHandle (hObject=0x214) returned 1 [0281.949] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.949] SetEndOfFile (hFile=0x218) returned 1 [0281.950] CloseHandle (hObject=0x218) returned 1 [0281.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0281.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.951] lstrlenW (lpString=".doc") returned 4 [0281.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.951] lstrlenW (lpString=".docx") returned 5 [0281.951] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.951] lstrlenW (lpString=".pdf") returned 4 [0281.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.951] lstrlenW (lpString=".xls") returned 4 [0281.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.951] lstrlenW (lpString=".xlsx") returned 5 [0281.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.951] lstrlenW (lpString=".ppt") returned 4 [0281.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.951] lstrlenW (lpString=".zip") returned 4 [0281.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.951] lstrlenW (lpString=".rar") returned 4 [0281.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.951] lstrlenW (lpString=".bz2") returned 4 [0281.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.951] lstrlenW (lpString=".7z") returned 3 [0281.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.951] lstrlenW (lpString=".dbf") returned 4 [0281.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.951] lstrlenW (lpString=".1cd") returned 4 [0281.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.952] lstrlenW (lpString=".jpg") returned 4 [0281.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.952] lstrlenW (lpString=".doc") returned 4 [0281.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.952] lstrlenW (lpString=".docx") returned 5 [0281.952] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.952] lstrlenW (lpString=".pdf") returned 4 [0281.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.952] lstrlenW (lpString=".xls") returned 4 [0281.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.952] lstrlenW (lpString=".xlsx") returned 5 [0281.952] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.952] lstrlenW (lpString=".ppt") returned 4 [0281.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.952] lstrlenW (lpString=".zip") returned 4 [0281.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.952] lstrlenW (lpString=".rar") returned 4 [0281.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.952] lstrlenW (lpString=".bz2") returned 4 [0281.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.952] lstrlenW (lpString=".7z") returned 3 [0281.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.952] lstrlenW (lpString=".dbf") returned 4 [0281.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.952] lstrlenW (lpString=".1cd") returned 4 [0281.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0281.953] lstrlenW (lpString=".jpg") returned 4 [0281.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.953] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0281.953] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0281.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.953] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=4991) returned 1 [0281.953] CloseHandle (hObject=0x218) returned 1 [0281.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0281.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.954] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.954] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0281.955] GetLastError () returned 0x0 [0281.955] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x137f, lpOverlapped=0x0) returned 1 [0281.982] WriteFile (in: hFile=0x214, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0281.983] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.983] WriteFile (in: hFile=0x214, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.983] SetEndOfFile (hFile=0x214) returned 1 [0281.983] CloseHandle (hObject=0x214) returned 1 [0281.983] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.983] SetEndOfFile (hFile=0x218) returned 1 [0281.984] CloseHandle (hObject=0x218) returned 1 [0281.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0281.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.985] lstrlenW (lpString=".doc") returned 4 [0281.985] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.985] lstrlenW (lpString=".docx") returned 5 [0281.985] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.985] lstrlenW (lpString=".pdf") returned 4 [0281.985] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.985] lstrlenW (lpString=".xls") returned 4 [0281.985] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.985] lstrlenW (lpString=".xlsx") returned 5 [0281.985] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.985] lstrlenW (lpString=".ppt") returned 4 [0281.985] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.985] lstrlenW (lpString=".zip") returned 4 [0281.985] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.985] lstrlenW (lpString=".rar") returned 4 [0281.986] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.986] lstrlenW (lpString=".bz2") returned 4 [0281.986] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.986] lstrlenW (lpString=".7z") returned 3 [0281.986] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.986] lstrlenW (lpString=".dbf") returned 4 [0281.986] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.986] lstrlenW (lpString=".1cd") returned 4 [0281.986] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.986] lstrlenW (lpString=".jpg") returned 4 [0281.986] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.986] lstrlenW (lpString=".doc") returned 4 [0281.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.986] lstrlenW (lpString=".docx") returned 5 [0281.986] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.986] lstrlenW (lpString=".pdf") returned 4 [0281.986] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.986] lstrlenW (lpString=".xls") returned 4 [0281.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.986] lstrlenW (lpString=".xlsx") returned 5 [0281.986] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.986] lstrlenW (lpString=".ppt") returned 4 [0281.987] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.987] lstrlenW (lpString=".zip") returned 4 [0281.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.987] lstrlenW (lpString=".rar") returned 4 [0281.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.987] lstrlenW (lpString=".bz2") returned 4 [0281.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.987] lstrlenW (lpString=".7z") returned 3 [0281.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.987] lstrlenW (lpString=".dbf") returned 4 [0281.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.987] lstrlenW (lpString=".1cd") returned 4 [0281.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0281.987] lstrlenW (lpString=".jpg") returned 4 [0281.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.987] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0281.987] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0281.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.988] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=2668) returned 1 [0281.988] CloseHandle (hObject=0x218) returned 1 [0281.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0281.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0281.988] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.988] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0281.998] GetLastError () returned 0x0 [0281.998] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0282.036] WriteFile (in: hFile=0x208, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0282.037] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.038] WriteFile (in: hFile=0x208, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xea, lpOverlapped=0x0) returned 1 [0282.038] SetEndOfFile (hFile=0x208) returned 1 [0282.038] CloseHandle (hObject=0x208) returned 1 [0282.038] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.038] SetEndOfFile (hFile=0x218) returned 1 [0282.039] CloseHandle (hObject=0x218) returned 1 [0282.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.039] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0282.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.039] lstrlenW (lpString=".doc") returned 4 [0282.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0282.039] lstrlenW (lpString=".docx") returned 5 [0282.039] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0282.039] lstrlenW (lpString=".pdf") returned 4 [0282.039] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0282.039] lstrlenW (lpString=".xls") returned 4 [0282.039] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0282.039] lstrlenW (lpString=".xlsx") returned 5 [0282.040] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0282.040] lstrlenW (lpString=".ppt") returned 4 [0282.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0282.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.040] lstrlenW (lpString=".zip") returned 4 [0282.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0282.040] lstrlenW (lpString=".rar") returned 4 [0282.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0282.040] lstrlenW (lpString=".bz2") returned 4 [0282.040] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0282.040] lstrlenW (lpString=".7z") returned 3 [0282.040] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0282.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.040] lstrlenW (lpString=".dbf") returned 4 [0282.040] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0282.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.040] lstrlenW (lpString=".1cd") returned 4 [0282.040] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0282.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.040] lstrlenW (lpString=".jpg") returned 4 [0282.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0282.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.040] lstrlenW (lpString=".doc") returned 4 [0282.040] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0282.040] lstrlenW (lpString=".docx") returned 5 [0282.040] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0282.040] lstrlenW (lpString=".pdf") returned 4 [0282.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0282.040] lstrlenW (lpString=".xls") returned 4 [0282.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0282.041] lstrlenW (lpString=".xlsx") returned 5 [0282.041] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0282.041] lstrlenW (lpString=".ppt") returned 4 [0282.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0282.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.041] lstrlenW (lpString=".zip") returned 4 [0282.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0282.041] lstrlenW (lpString=".rar") returned 4 [0282.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0282.041] lstrlenW (lpString=".bz2") returned 4 [0282.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0282.041] lstrlenW (lpString=".7z") returned 3 [0282.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0282.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.041] lstrlenW (lpString=".dbf") returned 4 [0282.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0282.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.041] lstrlenW (lpString=".1cd") returned 4 [0282.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0282.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0282.041] lstrlenW (lpString=".jpg") returned 4 [0282.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0282.042] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0282.042] lstrlenW (lpString="FM20.CHM") returned 8 [0282.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0282.043] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=334427) returned 1 [0282.043] CloseHandle (hObject=0x218) returned 1 [0282.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0282.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0282.044] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.044] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0282.044] GetLastError () returned 0x0 [0282.044] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0282.125] WriteFile (in: hFile=0x208, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0282.132] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.132] WriteFile (in: hFile=0x208, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0282.132] SetEndOfFile (hFile=0x208) returned 1 [0282.240] CloseHandle (hObject=0x208) returned 1 [0282.240] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.240] SetEndOfFile (hFile=0x218) returned 1 [0282.243] CloseHandle (hObject=0x218) returned 1 [0282.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0282.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.244] lstrlenW (lpString=".doc") returned 4 [0282.244] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.244] lstrlenW (lpString=".docx") returned 5 [0282.244] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0282.244] lstrlenW (lpString=".pdf") returned 4 [0282.244] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.244] lstrlenW (lpString=".xls") returned 4 [0282.244] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.244] lstrlenW (lpString=".xlsx") returned 5 [0282.244] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0282.244] lstrlenW (lpString=".ppt") returned 4 [0282.244] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.244] lstrlenW (lpString=".zip") returned 4 [0282.244] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString=".rar") returned 4 [0282.245] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString=".bz2") returned 4 [0282.245] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.245] lstrlenW (lpString=".7z") returned 3 [0282.245] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.245] lstrlenW (lpString=".dbf") returned 4 [0282.245] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.245] lstrlenW (lpString=".1cd") returned 4 [0282.245] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.245] lstrlenW (lpString=".jpg") returned 4 [0282.245] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.245] lstrlenW (lpString=".doc") returned 4 [0282.245] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString=".docx") returned 5 [0282.245] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0282.245] lstrlenW (lpString=".pdf") returned 4 [0282.245] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString=".xls") returned 4 [0282.245] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.245] lstrlenW (lpString=".xlsx") returned 5 [0282.245] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0282.245] lstrlenW (lpString=".ppt") returned 4 [0282.246] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.246] lstrlenW (lpString=".zip") returned 4 [0282.246] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.246] lstrlenW (lpString=".rar") returned 4 [0282.246] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.246] lstrlenW (lpString=".bz2") returned 4 [0282.246] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.246] lstrlenW (lpString=".7z") returned 3 [0282.246] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.246] lstrlenW (lpString=".dbf") returned 4 [0282.246] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.246] lstrlenW (lpString=".1cd") returned 4 [0282.246] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0282.246] lstrlenW (lpString=".jpg") returned 4 [0282.246] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.246] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0282.246] lstrlenW (lpString="VBLR6.CHM") returned 9 [0282.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0282.247] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=944994) returned 1 [0282.247] CloseHandle (hObject=0x218) returned 1 [0282.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0282.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0282.247] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.247] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0282.248] GetLastError () returned 0x0 [0282.248] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0282.894] WriteFile (in: hFile=0x208, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0282.910] ReadFile (in: hFile=0x218, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.910] WriteFile (in: hFile=0x208, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.910] SetEndOfFile (hFile=0x208) returned 1 [0282.910] CloseHandle (hObject=0x208) returned 1 [0282.910] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.910] SetEndOfFile (hFile=0x218) returned 1 [0282.917] CloseHandle (hObject=0x218) returned 1 [0282.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0282.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.918] lstrlenW (lpString=".doc") returned 4 [0282.918] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.918] lstrlenW (lpString=".docx") returned 5 [0282.918] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.918] lstrlenW (lpString=".pdf") returned 4 [0282.918] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.918] lstrlenW (lpString=".xls") returned 4 [0282.918] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.918] lstrlenW (lpString=".xlsx") returned 5 [0282.918] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.918] lstrlenW (lpString=".ppt") returned 4 [0282.918] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString=".zip") returned 4 [0282.919] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString=".rar") returned 4 [0282.919] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString=".bz2") returned 4 [0282.919] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.919] lstrlenW (lpString=".7z") returned 3 [0282.919] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString=".dbf") returned 4 [0282.919] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString=".1cd") returned 4 [0282.919] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString=".jpg") returned 4 [0282.919] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString=".doc") returned 4 [0282.919] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString=".docx") returned 5 [0282.919] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.919] lstrlenW (lpString=".pdf") returned 4 [0282.919] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString=".xls") returned 4 [0282.919] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString=".xlsx") returned 5 [0282.919] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.919] lstrlenW (lpString=".ppt") returned 4 [0282.919] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.919] lstrlenW (lpString=".zip") returned 4 [0282.919] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.919] lstrlenW (lpString=".rar") returned 4 [0282.920] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.920] lstrlenW (lpString=".bz2") returned 4 [0282.920] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.920] lstrlenW (lpString=".7z") returned 3 [0282.920] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.920] lstrlenW (lpString=".dbf") returned 4 [0282.920] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.920] lstrlenW (lpString=".1cd") returned 4 [0282.920] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0282.920] lstrlenW (lpString=".jpg") returned 4 [0282.920] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.920] lstrcmpiW (lpString1=".png", lpString2=".drweb") returned 1 [0282.920] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0282.920] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0283.244] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=3081) returned 1 [0283.244] CloseHandle (hObject=0x204) returned 1 [0283.244] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0283.244] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.244] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.245] lstrlenW (lpString=".doc") returned 4 [0283.245] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.245] lstrlenW (lpString=".docx") returned 5 [0283.245] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0283.245] lstrlenW (lpString=".pdf") returned 4 [0283.245] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.245] lstrlenW (lpString=".xls") returned 4 [0283.245] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.245] lstrlenW (lpString=".xlsx") returned 5 [0283.245] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0283.245] lstrlenW (lpString=".ppt") returned 4 [0283.245] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.245] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.245] lstrlenW (lpString=".zip") returned 4 [0283.246] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.246] lstrlenW (lpString=".rar") returned 4 [0283.246] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.246] lstrlenW (lpString=".bz2") returned 4 [0283.246] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.246] lstrlenW (lpString=".7z") returned 3 [0283.246] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.246] lstrlenW (lpString=".dbf") returned 4 [0283.246] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.246] lstrlenW (lpString=".1cd") returned 4 [0283.246] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.246] lstrlenW (lpString=".jpg") returned 4 [0283.246] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.246] lstrlenW (lpString=".doc") returned 4 [0283.247] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.247] lstrlenW (lpString=".docx") returned 5 [0283.247] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0283.247] lstrlenW (lpString=".pdf") returned 4 [0283.247] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.247] lstrlenW (lpString=".xls") returned 4 [0283.247] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.247] lstrlenW (lpString=".xlsx") returned 5 [0283.247] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0283.247] lstrlenW (lpString=".ppt") returned 4 [0283.247] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.247] lstrlenW (lpString=".zip") returned 4 [0283.247] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.247] lstrlenW (lpString=".rar") returned 4 [0283.247] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.247] lstrlenW (lpString=".bz2") returned 4 [0283.247] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.247] lstrlenW (lpString=".7z") returned 3 [0283.247] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.247] lstrlenW (lpString=".dbf") returned 4 [0283.247] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.248] lstrlenW (lpString=".1cd") returned 4 [0283.248] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0283.248] lstrlenW (lpString=".jpg") returned 4 [0283.248] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.248] lstrcmpiW (lpString1=".png", lpString2=".drweb") returned 1 [0283.248] lstrlenW (lpString="colorcycle.png") returned 14 [0283.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0283.543] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=17378) returned 1 [0283.543] CloseHandle (hObject=0x1c4) returned 1 [0283.543] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0283.543] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.543] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.543] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.543] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.543] lstrlenW (lpString=".doc") returned 4 [0283.543] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.543] lstrlenW (lpString=".docx") returned 5 [0283.543] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0283.543] lstrlenW (lpString=".pdf") returned 4 [0283.543] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.543] lstrlenW (lpString=".xls") returned 4 [0283.543] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.543] lstrlenW (lpString=".xlsx") returned 5 [0283.543] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0283.543] lstrlenW (lpString=".ppt") returned 4 [0283.543] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.543] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.543] lstrlenW (lpString=".zip") returned 4 [0283.543] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.544] lstrlenW (lpString=".rar") returned 4 [0283.544] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.544] lstrlenW (lpString=".bz2") returned 4 [0283.544] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.544] lstrlenW (lpString=".7z") returned 3 [0283.544] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.544] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.544] lstrlenW (lpString=".dbf") returned 4 [0283.544] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.544] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.544] lstrlenW (lpString=".1cd") returned 4 [0283.544] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.544] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.544] lstrlenW (lpString=".jpg") returned 4 [0283.544] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.544] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.544] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.544] lstrlenW (lpString=".doc") returned 4 [0283.544] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.544] lstrlenW (lpString=".docx") returned 5 [0283.544] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0283.544] lstrlenW (lpString=".pdf") returned 4 [0283.544] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.544] lstrlenW (lpString=".xls") returned 4 [0283.544] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.544] lstrlenW (lpString=".xlsx") returned 5 [0283.544] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0283.544] lstrlenW (lpString=".ppt") returned 4 [0283.545] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.545] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.545] lstrlenW (lpString=".zip") returned 4 [0283.545] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.545] lstrlenW (lpString=".rar") returned 4 [0283.545] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.545] lstrlenW (lpString=".bz2") returned 4 [0283.545] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.545] lstrlenW (lpString=".7z") returned 3 [0283.545] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.545] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.545] lstrlenW (lpString=".dbf") returned 4 [0283.545] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.545] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.545] lstrlenW (lpString=".1cd") returned 4 [0283.545] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.545] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 67 [0283.545] lstrlenW (lpString=".jpg") returned 4 [0283.545] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.545] lstrcmpiW (lpString1=".bmp", lpString2=".drweb") returned -1 [0283.545] lstrlenW (lpString="rectangle_glass_Thumbnail.bmp") returned 29 [0283.545] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.573] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=5072) returned 1 [0283.573] CloseHandle (hObject=0x1b0) returned 1 [0283.574] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0283.574] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.574] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.574] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.574] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.574] lstrlenW (lpString=".doc") returned 4 [0283.574] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString=".docx") returned 5 [0283.574] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0283.574] lstrlenW (lpString=".pdf") returned 4 [0283.574] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString=".xls") returned 4 [0283.574] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString=".xlsx") returned 5 [0283.574] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0283.574] lstrlenW (lpString=".ppt") returned 4 [0283.574] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.574] lstrlenW (lpString=".zip") returned 4 [0283.574] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString=".rar") returned 4 [0283.574] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString=".bz2") returned 4 [0283.574] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0283.574] lstrlenW (lpString=".7z") returned 3 [0283.574] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0283.574] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.574] lstrlenW (lpString=".dbf") returned 4 [0283.575] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString=".1cd") returned 4 [0283.575] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString=".jpg") returned 4 [0283.575] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString=".doc") returned 4 [0283.575] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString=".docx") returned 5 [0283.575] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0283.575] lstrlenW (lpString=".pdf") returned 4 [0283.575] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString=".xls") returned 4 [0283.575] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString=".xlsx") returned 5 [0283.575] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0283.575] lstrlenW (lpString=".ppt") returned 4 [0283.575] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString=".zip") returned 4 [0283.575] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString=".rar") returned 4 [0283.575] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString=".bz2") returned 4 [0283.575] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString=".7z") returned 3 [0283.575] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString=".dbf") returned 4 [0283.575] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0283.575] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.575] lstrlenW (lpString=".1cd") returned 4 [0283.575] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0283.576] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 73 [0283.576] lstrlenW (lpString=".jpg") returned 4 [0283.576] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0283.576] lstrcmpiW (lpString1=".bmp", lpString2=".drweb") returned -1 [0283.576] lstrlenW (lpString="rectangle_photo_Thumbnail.bmp") returned 29 [0283.576] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.577] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=5072) returned 1 [0283.577] CloseHandle (hObject=0x1b0) returned 1 [0283.577] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0283.577] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.577] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.577] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.577] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.577] lstrlenW (lpString=".doc") returned 4 [0283.577] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0283.577] lstrlenW (lpString=".docx") returned 5 [0283.577] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0283.577] lstrlenW (lpString=".pdf") returned 4 [0283.577] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0283.577] lstrlenW (lpString=".xls") returned 4 [0283.577] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0283.577] lstrlenW (lpString=".xlsx") returned 5 [0283.577] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0283.577] lstrlenW (lpString=".ppt") returned 4 [0283.577] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0283.577] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.577] lstrlenW (lpString=".zip") returned 4 [0283.577] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0283.577] lstrlenW (lpString=".rar") returned 4 [0283.577] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0283.577] lstrlenW (lpString=".bz2") returned 4 [0283.578] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".7z") returned 3 [0283.578] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0283.578] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.578] lstrlenW (lpString=".dbf") returned 4 [0283.578] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.578] lstrlenW (lpString=".1cd") returned 4 [0283.578] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0283.578] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.578] lstrlenW (lpString=".jpg") returned 4 [0283.578] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.578] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.578] lstrlenW (lpString=".doc") returned 4 [0283.578] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".docx") returned 5 [0283.578] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0283.578] lstrlenW (lpString=".pdf") returned 4 [0283.578] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".xls") returned 4 [0283.578] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".xlsx") returned 5 [0283.578] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0283.578] lstrlenW (lpString=".ppt") returned 4 [0283.578] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.578] lstrlenW (lpString=".zip") returned 4 [0283.578] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".rar") returned 4 [0283.578] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".bz2") returned 4 [0283.578] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0283.578] lstrlenW (lpString=".7z") returned 3 [0283.578] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0283.579] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.579] lstrlenW (lpString=".dbf") returned 4 [0283.579] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0283.579] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.579] lstrlenW (lpString=".1cd") returned 4 [0283.579] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0283.579] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 73 [0283.579] lstrlenW (lpString=".jpg") returned 4 [0283.579] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0283.579] lstrcmpiW (lpString1=".bmp", lpString2=".drweb") returned -1 [0283.579] lstrlenW (lpString="rectangle_plain_Thumbnail.bmp") returned 29 [0283.579] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.579] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=5072) returned 1 [0283.579] CloseHandle (hObject=0x1b0) returned 1 [0283.579] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0283.580] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.580] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.580] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0283.580] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0283.580] lstrlenW (lpString=".doc") returned 4 [0283.580] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0283.580] lstrlenW (lpString=".docx") returned 5 [0283.580] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0283.580] lstrlenW (lpString=".pdf") returned 4 [0283.580] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0283.580] lstrlenW (lpString=".xls") returned 4 [0283.580] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0283.580] lstrlenW (lpString=".xlsx") returned 5 [0283.580] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0283.580] lstrlenW (lpString=".ppt") returned 4 [0283.580] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0283.580] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0283.580] lstrlenW (lpString=".zip") returned 4 [0283.580] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0283.580] lstrlenW (lpString=".rar") returned 4 [0283.581] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0283.581] lstrlenW (lpString=".bz2") returned 4 [0283.581] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0283.581] lstrlenW (lpString=".7z") returned 3 [0283.581] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0283.581] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0283.581] lstrlenW (lpString=".dbf") returned 4 [0283.581] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0283.581] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0283.581] lstrlenW (lpString=".1cd") returned 4 [0283.581] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0283.581] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 73 [0283.581] lstrlenW (lpString=".jpg") returned 4 [0283.581] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0283.601] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.601] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0283.601] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0283.601] lstrlenW (lpString=".doc") returned 4 [0283.601] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.601] lstrlenW (lpString=".docx") returned 5 [0283.601] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0283.601] lstrlenW (lpString=".pdf") returned 4 [0283.601] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.601] lstrlenW (lpString=".xls") returned 4 [0283.601] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.601] lstrlenW (lpString=".xlsx") returned 5 [0283.601] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0283.601] lstrlenW (lpString=".ppt") returned 4 [0283.601] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.601] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0283.601] lstrlenW (lpString=".zip") returned 4 [0283.601] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.601] lstrlenW (lpString=".rar") returned 4 [0283.601] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.601] lstrlenW (lpString=".bz2") returned 4 [0283.601] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.601] lstrlenW (lpString=".7z") returned 3 [0283.601] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.602] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0283.602] lstrlenW (lpString=".dbf") returned 4 [0283.602] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.602] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0283.602] lstrlenW (lpString=".1cd") returned 4 [0283.602] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0283.602] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0283.602] lstrlenW (lpString=".jpg") returned 4 [0283.602] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0283.602] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.602] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0283.602] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0283.602] lstrlenW (lpString=".doc") returned 4 [0283.602] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.602] lstrlenW (lpString=".docx") returned 5 [0283.602] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0283.602] lstrlenW (lpString=".pdf") returned 4 [0283.602] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.602] lstrlenW (lpString=".xls") returned 4 [0283.602] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.602] lstrlenW (lpString=".xlsx") returned 5 [0283.603] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0283.603] lstrlenW (lpString=".ppt") returned 4 [0283.603] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.603] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0283.603] lstrlenW (lpString=".zip") returned 4 [0283.603] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.603] lstrlenW (lpString=".rar") returned 4 [0283.603] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.603] lstrlenW (lpString=".bz2") returned 4 [0283.603] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.603] lstrlenW (lpString=".7z") returned 3 [0283.603] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.603] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0283.603] lstrlenW (lpString=".dbf") returned 4 [0283.603] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.603] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0283.603] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.910] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0284.987] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=30948) returned 1 [0284.987] CloseHandle (hObject=0x204) returned 1 [0284.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0284.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0284.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0284.989] GetLastError () returned 0x0 [0284.989] ReadFile (in: hFile=0x204, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0285.113] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0285.114] ReadFile (in: hFile=0x204, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.114] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.114] SetEndOfFile (hFile=0x1e0) returned 1 [0285.144] CloseHandle (hObject=0x1e0) returned 1 [0285.144] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.145] SetEndOfFile (hFile=0x204) returned 1 [0285.146] CloseHandle (hObject=0x204) returned 1 [0285.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0285.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0285.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0285.146] lstrlenW (lpString=".doc") returned 4 [0285.146] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0285.146] lstrlenW (lpString=".docx") returned 5 [0285.146] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0285.146] lstrlenW (lpString=".pdf") returned 4 [0285.146] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0285.146] lstrlenW (lpString=".xls") returned 4 [0285.147] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0285.147] lstrlenW (lpString=".xlsx") returned 5 [0285.147] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0285.147] lstrlenW (lpString=".ppt") returned 4 [0285.147] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0285.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0285.147] lstrlenW (lpString=".zip") returned 4 [0285.147] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0285.147] lstrlenW (lpString=".rar") returned 4 [0285.147] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0285.147] lstrlenW (lpString=".bz2") returned 4 [0285.147] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0285.147] lstrlenW (lpString=".7z") returned 3 [0285.147] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0285.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0285.147] lstrlenW (lpString=".dbf") returned 4 [0285.147] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0285.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0285.147] lstrlenW (lpString=".1cd") returned 4 [0285.147] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0285.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0285.147] lstrlenW (lpString=".jpg") returned 4 [0285.147] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0285.148] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.148] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0285.149] GetLastError () returned 0x0 [0285.149] ReadFile (in: hFile=0x204, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0285.235] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0285.236] ReadFile (in: hFile=0x204, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.236] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.236] SetEndOfFile (hFile=0x1e0) returned 1 [0285.349] CloseHandle (hObject=0x1e0) returned 1 [0285.349] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.349] SetEndOfFile (hFile=0x204) returned 1 [0285.350] CloseHandle (hObject=0x204) returned 1 [0285.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0285.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0285.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0285.351] lstrlenW (lpString=".doc") returned 4 [0285.351] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.351] lstrlenW (lpString=".docx") returned 5 [0285.351] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.351] lstrlenW (lpString=".pdf") returned 4 [0285.351] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.351] lstrlenW (lpString=".xls") returned 4 [0285.351] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.351] lstrlenW (lpString=".xlsx") returned 5 [0285.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.351] lstrlenW (lpString=".ppt") returned 4 [0285.351] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0285.351] lstrlenW (lpString=".zip") returned 4 [0285.351] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.351] lstrlenW (lpString=".rar") returned 4 [0285.351] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.351] lstrlenW (lpString=".bz2") returned 4 [0285.351] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.351] lstrlenW (lpString=".7z") returned 3 [0285.351] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0285.351] lstrlenW (lpString=".dbf") returned 4 [0285.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0285.351] lstrlenW (lpString=".1cd") returned 4 [0285.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0285.352] lstrlenW (lpString=".jpg") returned 4 [0285.352] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.507] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.508] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0285.508] GetLastError () returned 0x0 [0285.508] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0285.777] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0285.814] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.814] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.814] SetEndOfFile (hFile=0x1dc) returned 1 [0285.815] CloseHandle (hObject=0x1dc) returned 1 [0285.815] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.815] SetEndOfFile (hFile=0x20c) returned 1 [0285.816] CloseHandle (hObject=0x20c) returned 1 [0285.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0285.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0285.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0285.816] lstrlenW (lpString=".doc") returned 4 [0285.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.817] lstrlenW (lpString=".docx") returned 5 [0285.817] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.817] lstrlenW (lpString=".pdf") returned 4 [0285.817] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.817] lstrlenW (lpString=".xls") returned 4 [0285.817] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.817] lstrlenW (lpString=".xlsx") returned 5 [0285.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.817] lstrlenW (lpString=".ppt") returned 4 [0285.817] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0285.817] lstrlenW (lpString=".zip") returned 4 [0285.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.817] lstrlenW (lpString=".rar") returned 4 [0285.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.817] lstrlenW (lpString=".bz2") returned 4 [0285.817] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.817] lstrlenW (lpString=".7z") returned 3 [0285.817] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0285.817] lstrlenW (lpString=".dbf") returned 4 [0285.817] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0285.817] lstrlenW (lpString=".1cd") returned 4 [0285.818] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0285.818] lstrlenW (lpString=".jpg") returned 4 [0285.818] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.818] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.818] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0285.819] GetLastError () returned 0x0 [0285.819] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0286.254] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0286.255] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.255] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.255] SetEndOfFile (hFile=0x1dc) returned 1 [0286.534] CloseHandle (hObject=0x1dc) returned 1 [0286.535] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.535] SetEndOfFile (hFile=0x20c) returned 1 [0286.535] CloseHandle (hObject=0x20c) returned 1 [0286.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0286.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0286.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0286.536] lstrlenW (lpString=".doc") returned 4 [0286.536] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.537] lstrlenW (lpString=".docx") returned 5 [0286.537] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.537] lstrlenW (lpString=".pdf") returned 4 [0286.537] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.537] lstrlenW (lpString=".xls") returned 4 [0286.537] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.537] lstrlenW (lpString=".xlsx") returned 5 [0286.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.537] lstrlenW (lpString=".ppt") returned 4 [0286.537] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0286.537] lstrlenW (lpString=".zip") returned 4 [0286.537] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.537] lstrlenW (lpString=".rar") returned 4 [0286.537] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.537] lstrlenW (lpString=".bz2") returned 4 [0286.537] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.537] lstrlenW (lpString=".7z") returned 3 [0286.537] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0286.537] lstrlenW (lpString=".dbf") returned 4 [0286.537] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0286.537] lstrlenW (lpString=".1cd") returned 4 [0286.537] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0286.537] lstrlenW (lpString=".jpg") returned 4 [0286.537] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.538] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.538] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0286.538] GetLastError () returned 0x0 [0286.538] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0286.561] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0286.562] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.562] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.562] SetEndOfFile (hFile=0x1dc) returned 1 [0286.562] CloseHandle (hObject=0x1dc) returned 1 [0286.562] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.562] SetEndOfFile (hFile=0x20c) returned 1 [0286.563] CloseHandle (hObject=0x20c) returned 1 [0286.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0286.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0286.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0286.564] lstrlenW (lpString=".doc") returned 4 [0286.564] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.564] lstrlenW (lpString=".docx") returned 5 [0286.564] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.564] lstrlenW (lpString=".pdf") returned 4 [0286.564] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.564] lstrlenW (lpString=".xls") returned 4 [0286.564] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.564] lstrlenW (lpString=".xlsx") returned 5 [0286.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.564] lstrlenW (lpString=".ppt") returned 4 [0286.564] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0286.564] lstrlenW (lpString=".zip") returned 4 [0286.564] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.564] lstrlenW (lpString=".rar") returned 4 [0286.564] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.564] lstrlenW (lpString=".bz2") returned 4 [0286.564] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.564] lstrlenW (lpString=".7z") returned 3 [0286.564] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0286.565] lstrlenW (lpString=".dbf") returned 4 [0286.565] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0286.565] lstrlenW (lpString=".1cd") returned 4 [0286.565] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0286.565] lstrlenW (lpString=".jpg") returned 4 [0286.565] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.565] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.565] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0286.565] GetLastError () returned 0x0 [0286.565] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x1485, lpOverlapped=0x0) returned 1 [0286.584] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0286.585] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.585] WriteFile (in: hFile=0x1dc, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.585] SetEndOfFile (hFile=0x1dc) returned 1 [0286.706] CloseHandle (hObject=0x1dc) returned 1 [0287.128] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.128] SetEndOfFile (hFile=0x20c) returned 1 [0287.129] CloseHandle (hObject=0x20c) returned 1 [0287.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0287.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0287.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0287.139] lstrlenW (lpString=".doc") returned 4 [0287.139] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.139] lstrlenW (lpString=".docx") returned 5 [0287.139] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.139] lstrlenW (lpString=".pdf") returned 4 [0287.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.139] lstrlenW (lpString=".xls") returned 4 [0287.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.139] lstrlenW (lpString=".xlsx") returned 5 [0287.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.139] lstrlenW (lpString=".ppt") returned 4 [0287.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0287.139] lstrlenW (lpString=".zip") returned 4 [0287.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.139] lstrlenW (lpString=".rar") returned 4 [0287.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.139] lstrlenW (lpString=".bz2") returned 4 [0287.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.139] lstrlenW (lpString=".7z") returned 3 [0287.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0287.139] lstrlenW (lpString=".dbf") returned 4 [0287.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0287.139] lstrlenW (lpString=".1cd") returned 4 [0287.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0287.140] lstrlenW (lpString=".jpg") returned 4 [0287.140] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.140] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.140] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0287.141] GetLastError () returned 0x0 [0287.141] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x131e, lpOverlapped=0x0) returned 1 [0287.162] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0287.163] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.164] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.164] SetEndOfFile (hFile=0x1e0) returned 1 [0287.164] CloseHandle (hObject=0x1e0) returned 1 [0287.164] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.164] SetEndOfFile (hFile=0x20c) returned 1 [0287.165] CloseHandle (hObject=0x20c) returned 1 [0287.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0287.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0287.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0287.166] lstrlenW (lpString=".doc") returned 4 [0287.166] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.166] lstrlenW (lpString=".docx") returned 5 [0287.166] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.166] lstrlenW (lpString=".pdf") returned 4 [0287.166] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.166] lstrlenW (lpString=".xls") returned 4 [0287.166] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.166] lstrlenW (lpString=".xlsx") returned 5 [0287.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.167] lstrlenW (lpString=".ppt") returned 4 [0287.167] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0287.167] lstrlenW (lpString=".zip") returned 4 [0287.167] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.167] lstrlenW (lpString=".rar") returned 4 [0287.167] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.167] lstrlenW (lpString=".bz2") returned 4 [0287.167] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.167] lstrlenW (lpString=".7z") returned 3 [0287.167] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0287.167] lstrlenW (lpString=".dbf") returned 4 [0287.167] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0287.167] lstrlenW (lpString=".1cd") returned 4 [0287.167] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0287.167] lstrlenW (lpString=".jpg") returned 4 [0287.167] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.168] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.168] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0287.171] GetLastError () returned 0x0 [0287.171] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x1398, lpOverlapped=0x0) returned 1 [0287.182] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0287.183] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.183] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.184] SetEndOfFile (hFile=0x1e0) returned 1 [0287.195] CloseHandle (hObject=0x1e0) returned 1 [0287.195] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.195] SetEndOfFile (hFile=0x20c) returned 1 [0287.196] CloseHandle (hObject=0x20c) returned 1 [0287.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0287.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0287.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0287.197] lstrlenW (lpString=".doc") returned 4 [0287.197] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.197] lstrlenW (lpString=".docx") returned 5 [0287.197] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.197] lstrlenW (lpString=".pdf") returned 4 [0287.197] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.197] lstrlenW (lpString=".xls") returned 4 [0287.197] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.197] lstrlenW (lpString=".xlsx") returned 5 [0287.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.198] lstrlenW (lpString=".ppt") returned 4 [0287.198] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0287.198] lstrlenW (lpString=".zip") returned 4 [0287.198] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.198] lstrlenW (lpString=".rar") returned 4 [0287.198] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.198] lstrlenW (lpString=".bz2") returned 4 [0287.198] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.198] lstrlenW (lpString=".7z") returned 3 [0287.198] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0287.198] lstrlenW (lpString=".dbf") returned 4 [0287.198] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0287.198] lstrlenW (lpString=".1cd") returned 4 [0287.198] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0287.198] lstrlenW (lpString=".jpg") returned 4 [0287.198] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.199] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x224ff1c | out: lpFileSize=0x224ff1c*=3378) returned 1 [0287.199] CloseHandle (hObject=0x20c) returned 1 [0287.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0287.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0287.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0287.206] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.206] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x224fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0287.207] GetLastError () returned 0x0 [0287.207] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0xd32, lpOverlapped=0x0) returned 1 [0287.283] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0287.285] ReadFile (in: hFile=0x20c, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x224fed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x224fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.285] WriteFile (in: hFile=0x1e0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x224fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x224fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.285] SetEndOfFile (hFile=0x1e0) Thread: id = 10 os_tid = 0x150 [0260.780] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x380678 [0260.780] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x390680 [0260.781] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330480 [0260.781] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x31a3a0 [0260.781] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330498 [0260.781] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3660020 [0260.781] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304b0 [0260.781] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3304b0, Size=0x20) returned 0x35fb00 [0260.781] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304b0 [0260.781] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3304b0, Size=0x20) returned 0x35fad8 [0260.782] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.782] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.782] Wow64DisableWow64FsRedirection (in: OldValue=0x2b4ff58 | out: OldValue=0x2b4ff58*=0x0) returned 1 [0260.783] lstrlenW (lpString="kernel32.dll") returned 12 [0260.783] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.783] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.783] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.783] Sleep (dwMilliseconds=0x64) [0261.294] lstrcmpiW (lpString1=".LOG1", lpString2=".drweb") returned 1 [0261.294] lstrlenW (lpString="BCD.LOG1") returned 8 [0261.294] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.367] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=0) returned 1 [0261.367] CloseHandle (hObject=0x174) returned 1 [0261.367] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.367] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.367] lstrlenW (lpString=".doc") returned 4 [0261.367] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0261.367] lstrlenW (lpString=".docx") returned 5 [0261.367] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0261.367] lstrlenW (lpString=".pdf") returned 4 [0261.367] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0261.367] lstrlenW (lpString=".xls") returned 4 [0261.367] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0261.367] lstrlenW (lpString=".xlsx") returned 5 [0261.367] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0261.367] lstrlenW (lpString=".ppt") returned 4 [0261.367] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0261.367] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.367] lstrlenW (lpString=".zip") returned 4 [0261.367] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0261.367] lstrlenW (lpString=".rar") returned 4 [0261.367] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0261.367] lstrlenW (lpString=".bz2") returned 4 [0261.367] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString=".7z") returned 3 [0261.368] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0261.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.368] lstrlenW (lpString=".dbf") returned 4 [0261.368] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.368] lstrlenW (lpString=".1cd") returned 4 [0261.368] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.368] lstrlenW (lpString=".jpg") returned 4 [0261.368] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.368] lstrlenW (lpString=".doc") returned 4 [0261.368] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString=".docx") returned 5 [0261.368] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0261.368] lstrlenW (lpString=".pdf") returned 4 [0261.368] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString=".xls") returned 4 [0261.368] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString=".xlsx") returned 5 [0261.368] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0261.368] lstrlenW (lpString=".ppt") returned 4 [0261.368] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0261.368] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.368] lstrlenW (lpString=".zip") returned 4 [0261.368] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0261.369] lstrlenW (lpString=".rar") returned 4 [0261.369] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0261.369] lstrlenW (lpString=".bz2") returned 4 [0261.369] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0261.369] lstrlenW (lpString=".7z") returned 3 [0261.369] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0261.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.369] lstrlenW (lpString=".dbf") returned 4 [0261.369] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0261.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.369] lstrlenW (lpString=".1cd") returned 4 [0261.369] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0261.369] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0261.369] lstrlenW (lpString=".jpg") returned 4 [0261.369] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0261.369] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.369] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.369] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.370] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=75344) returned 1 [0261.370] CloseHandle (hObject=0x174) returned 1 [0261.370] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0261.370] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.370] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.370] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.370] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.370] lstrlenW (lpString=".doc") returned 4 [0261.370] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.370] lstrlenW (lpString=".docx") returned 5 [0261.370] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.370] lstrlenW (lpString=".pdf") returned 4 [0261.370] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.370] lstrlenW (lpString=".xls") returned 4 [0261.370] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.370] lstrlenW (lpString=".xlsx") returned 5 [0261.370] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.370] lstrlenW (lpString=".ppt") returned 4 [0261.370] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.370] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.370] lstrlenW (lpString=".zip") returned 4 [0261.370] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.370] lstrlenW (lpString=".rar") returned 4 [0261.371] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.371] lstrlenW (lpString=".bz2") returned 4 [0261.371] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.371] lstrlenW (lpString=".7z") returned 3 [0261.371] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.371] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.371] lstrlenW (lpString=".dbf") returned 4 [0261.371] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.371] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.371] lstrlenW (lpString=".1cd") returned 4 [0261.371] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.371] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.371] lstrlenW (lpString=".jpg") returned 4 [0261.371] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.371] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.371] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.371] lstrlenW (lpString=".doc") returned 4 [0261.371] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.371] lstrlenW (lpString=".docx") returned 5 [0261.371] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.371] lstrlenW (lpString=".pdf") returned 4 [0261.371] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.371] lstrlenW (lpString=".xls") returned 4 [0261.371] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.371] lstrlenW (lpString=".xlsx") returned 5 [0261.371] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.371] lstrlenW (lpString=".ppt") returned 4 [0261.371] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.372] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.372] lstrlenW (lpString=".zip") returned 4 [0261.372] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.372] lstrlenW (lpString=".rar") returned 4 [0261.372] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.372] lstrlenW (lpString=".bz2") returned 4 [0261.372] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.372] lstrlenW (lpString=".7z") returned 3 [0261.372] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.372] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.372] lstrlenW (lpString=".dbf") returned 4 [0261.372] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.372] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.372] lstrlenW (lpString=".1cd") returned 4 [0261.372] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.372] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0261.372] lstrlenW (lpString=".jpg") returned 4 [0261.372] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.372] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0261.372] lstrlenW (lpString="memtest.exe") returned 11 [0261.372] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.373] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=485760) returned 1 [0261.373] CloseHandle (hObject=0x174) returned 1 [0261.373] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0261.373] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.373] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.373] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.373] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.373] lstrlenW (lpString=".doc") returned 4 [0261.373] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0261.373] lstrlenW (lpString=".docx") returned 5 [0261.373] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0261.373] lstrlenW (lpString=".pdf") returned 4 [0261.373] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0261.373] lstrlenW (lpString=".xls") returned 4 [0261.373] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0261.373] lstrlenW (lpString=".xlsx") returned 5 [0261.373] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0261.373] lstrlenW (lpString=".ppt") returned 4 [0261.373] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0261.374] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.374] lstrlenW (lpString=".zip") returned 4 [0261.374] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0261.374] lstrlenW (lpString=".rar") returned 4 [0261.374] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0261.374] lstrlenW (lpString=".bz2") returned 4 [0261.374] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0261.374] lstrlenW (lpString=".7z") returned 3 [0261.374] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0261.374] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.374] lstrlenW (lpString=".dbf") returned 4 [0261.374] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0261.374] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.374] lstrlenW (lpString=".1cd") returned 4 [0261.374] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0261.374] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.374] lstrlenW (lpString=".jpg") returned 4 [0261.374] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0261.374] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.374] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.374] lstrlenW (lpString=".doc") returned 4 [0261.374] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0261.374] lstrlenW (lpString=".docx") returned 5 [0261.374] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0261.374] lstrlenW (lpString=".pdf") returned 4 [0261.374] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0261.374] lstrlenW (lpString=".xls") returned 4 [0261.374] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0261.375] lstrlenW (lpString=".xlsx") returned 5 [0261.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0261.375] lstrlenW (lpString=".ppt") returned 4 [0261.375] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0261.375] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.375] lstrlenW (lpString=".zip") returned 4 [0261.375] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0261.375] lstrlenW (lpString=".rar") returned 4 [0261.375] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0261.375] lstrlenW (lpString=".bz2") returned 4 [0261.375] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0261.375] lstrlenW (lpString=".7z") returned 3 [0261.375] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0261.375] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.375] lstrlenW (lpString=".dbf") returned 4 [0261.375] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0261.375] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.375] lstrlenW (lpString=".1cd") returned 4 [0261.375] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0261.375] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0261.375] lstrlenW (lpString=".jpg") returned 4 [0261.375] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0261.375] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.375] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.376] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.376] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=88144) returned 1 [0261.376] CloseHandle (hObject=0x174) returned 1 [0261.376] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0261.376] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.376] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.376] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.376] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.376] lstrlenW (lpString=".doc") returned 4 [0261.376] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.376] lstrlenW (lpString=".docx") returned 5 [0261.376] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.376] lstrlenW (lpString=".pdf") returned 4 [0261.376] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.376] lstrlenW (lpString=".xls") returned 4 [0261.377] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.377] lstrlenW (lpString=".xlsx") returned 5 [0261.377] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.377] lstrlenW (lpString=".ppt") returned 4 [0261.377] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.377] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.377] lstrlenW (lpString=".zip") returned 4 [0261.377] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.377] lstrlenW (lpString=".rar") returned 4 [0261.377] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.377] lstrlenW (lpString=".bz2") returned 4 [0261.377] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.377] lstrlenW (lpString=".7z") returned 3 [0261.377] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.377] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.377] lstrlenW (lpString=".dbf") returned 4 [0261.377] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.377] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.377] lstrlenW (lpString=".1cd") returned 4 [0261.377] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.377] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.377] lstrlenW (lpString=".jpg") returned 4 [0261.377] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.377] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.377] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.377] lstrlenW (lpString=".doc") returned 4 [0261.377] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.378] lstrlenW (lpString=".docx") returned 5 [0261.378] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.378] lstrlenW (lpString=".pdf") returned 4 [0261.378] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.378] lstrlenW (lpString=".xls") returned 4 [0261.378] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.378] lstrlenW (lpString=".xlsx") returned 5 [0261.378] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.378] lstrlenW (lpString=".ppt") returned 4 [0261.378] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.378] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.378] lstrlenW (lpString=".zip") returned 4 [0261.378] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.378] lstrlenW (lpString=".rar") returned 4 [0261.378] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.378] lstrlenW (lpString=".bz2") returned 4 [0261.378] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.378] lstrlenW (lpString=".7z") returned 3 [0261.378] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.378] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.378] lstrlenW (lpString=".dbf") returned 4 [0261.378] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.378] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.378] lstrlenW (lpString=".1cd") returned 4 [0261.378] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.378] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0261.378] lstrlenW (lpString=".jpg") returned 4 [0261.378] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.379] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.379] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.379] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.379] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=90704) returned 1 [0261.379] CloseHandle (hObject=0x174) returned 1 [0261.379] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0261.379] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.379] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.379] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.379] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.379] lstrlenW (lpString=".doc") returned 4 [0261.380] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.380] lstrlenW (lpString=".docx") returned 5 [0261.380] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.380] lstrlenW (lpString=".pdf") returned 4 [0261.380] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.380] lstrlenW (lpString=".xls") returned 4 [0261.380] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.380] lstrlenW (lpString=".xlsx") returned 5 [0261.380] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.380] lstrlenW (lpString=".ppt") returned 4 [0261.380] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.380] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.380] lstrlenW (lpString=".zip") returned 4 [0261.380] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.380] lstrlenW (lpString=".rar") returned 4 [0261.380] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.380] lstrlenW (lpString=".bz2") returned 4 [0261.380] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.380] lstrlenW (lpString=".7z") returned 3 [0261.380] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.380] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.380] lstrlenW (lpString=".dbf") returned 4 [0261.380] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.380] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.380] lstrlenW (lpString=".1cd") returned 4 [0261.380] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.380] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.380] lstrlenW (lpString=".jpg") returned 4 [0261.380] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.381] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.381] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.381] lstrlenW (lpString=".doc") returned 4 [0261.381] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.381] lstrlenW (lpString=".docx") returned 5 [0261.381] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.381] lstrlenW (lpString=".pdf") returned 4 [0261.381] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.381] lstrlenW (lpString=".xls") returned 4 [0261.381] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.381] lstrlenW (lpString=".xlsx") returned 5 [0261.381] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.381] lstrlenW (lpString=".ppt") returned 4 [0261.381] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.381] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.381] lstrlenW (lpString=".zip") returned 4 [0261.381] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.381] lstrlenW (lpString=".rar") returned 4 [0261.381] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.381] lstrlenW (lpString=".bz2") returned 4 [0261.381] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.381] lstrlenW (lpString=".7z") returned 3 [0261.381] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.382] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.382] lstrlenW (lpString=".dbf") returned 4 [0261.382] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.382] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.382] lstrlenW (lpString=".1cd") returned 4 [0261.382] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.382] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0261.382] lstrlenW (lpString=".jpg") returned 4 [0261.382] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.382] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.382] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.382] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.382] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=90704) returned 1 [0261.382] CloseHandle (hObject=0x174) returned 1 [0261.382] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0261.383] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.383] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.383] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.383] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.383] lstrlenW (lpString=".doc") returned 4 [0261.383] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.383] lstrlenW (lpString=".docx") returned 5 [0261.383] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.383] lstrlenW (lpString=".pdf") returned 4 [0261.383] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.383] lstrlenW (lpString=".xls") returned 4 [0261.383] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.383] lstrlenW (lpString=".xlsx") returned 5 [0261.383] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.383] lstrlenW (lpString=".ppt") returned 4 [0261.383] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.383] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.383] lstrlenW (lpString=".zip") returned 4 [0261.383] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.383] lstrlenW (lpString=".rar") returned 4 [0261.383] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.383] lstrlenW (lpString=".bz2") returned 4 [0261.383] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.383] lstrlenW (lpString=".7z") returned 3 [0261.384] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.384] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.384] lstrlenW (lpString=".dbf") returned 4 [0261.384] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.384] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.384] lstrlenW (lpString=".1cd") returned 4 [0261.384] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.384] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.384] lstrlenW (lpString=".jpg") returned 4 [0261.384] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.384] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.384] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.384] lstrlenW (lpString=".doc") returned 4 [0261.384] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.384] lstrlenW (lpString=".docx") returned 5 [0261.384] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.384] lstrlenW (lpString=".pdf") returned 4 [0261.384] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.384] lstrlenW (lpString=".xls") returned 4 [0261.384] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.384] lstrlenW (lpString=".xlsx") returned 5 [0261.384] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.384] lstrlenW (lpString=".ppt") returned 4 [0261.384] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.385] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.385] lstrlenW (lpString=".zip") returned 4 [0261.385] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.385] lstrlenW (lpString=".rar") returned 4 [0261.385] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.385] lstrlenW (lpString=".bz2") returned 4 [0261.385] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.385] lstrlenW (lpString=".7z") returned 3 [0261.385] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.385] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.385] lstrlenW (lpString=".dbf") returned 4 [0261.385] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.385] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.385] lstrlenW (lpString=".1cd") returned 4 [0261.385] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.385] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0261.385] lstrlenW (lpString=".jpg") returned 4 [0261.385] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.385] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.385] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.385] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.386] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=90176) returned 1 [0261.386] CloseHandle (hObject=0x174) returned 1 [0261.386] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0261.386] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.386] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.386] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0261.386] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0261.386] lstrlenW (lpString=".doc") returned 4 [0261.386] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.386] lstrlenW (lpString=".docx") returned 5 [0261.386] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.386] lstrlenW (lpString=".pdf") returned 4 [0261.386] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.386] lstrlenW (lpString=".xls") returned 4 [0261.386] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.386] lstrlenW (lpString=".xlsx") returned 5 [0261.387] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.387] lstrlenW (lpString=".ppt") returned 4 [0261.387] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.387] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0261.387] lstrlenW (lpString=".zip") returned 4 [0261.387] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.387] lstrlenW (lpString=".rar") returned 4 [0261.387] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.387] lstrlenW (lpString=".bz2") returned 4 [0261.387] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.387] lstrlenW (lpString=".7z") returned 3 [0261.387] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0262.131] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0262.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0262.746] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0262.746] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0262.746] ReadFile (in: hFile=0x18c, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.804] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0262.804] ReadFile (in: hFile=0x18c, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.928] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0262.928] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0262.928] ReadFile (in: hFile=0x18c, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.971] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.971] WriteFile (in: hFile=0x18c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0263.169] SetEndOfFile (hFile=0x18c) returned 1 [0263.169] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f33888 [0263.170] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0263.170] WriteFile (in: hFile=0x18c, lpBuffer=0x3f33888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33888*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.171] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0263.171] WriteFile (in: hFile=0x18c, lpBuffer=0x3f33888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33888*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.172] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0263.172] WriteFile (in: hFile=0x18c, lpBuffer=0x3f33888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33888*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.173] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f33888 | out: hHeap=0x2e0000) returned 1 [0263.173] CloseHandle (hObject=0x18c) returned 1 [0266.803] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0266.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.803] lstrlenW (lpString=".doc") returned 4 [0266.803] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0266.803] lstrlenW (lpString=".docx") returned 5 [0266.803] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0266.803] lstrlenW (lpString=".pdf") returned 4 [0266.803] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0266.803] lstrlenW (lpString=".xls") returned 4 [0266.803] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0266.803] lstrlenW (lpString=".xlsx") returned 5 [0266.804] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0266.804] lstrlenW (lpString=".ppt") returned 4 [0266.804] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.804] lstrlenW (lpString=".zip") returned 4 [0266.804] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString=".rar") returned 4 [0266.804] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString=".bz2") returned 4 [0266.804] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0266.804] lstrlenW (lpString=".7z") returned 3 [0266.804] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0266.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.804] lstrlenW (lpString=".dbf") returned 4 [0266.804] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.804] lstrlenW (lpString=".1cd") returned 4 [0266.804] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0266.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.804] lstrlenW (lpString=".jpg") returned 4 [0266.804] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.804] lstrlenW (lpString=".doc") returned 4 [0266.804] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString=".docx") returned 5 [0266.804] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0266.804] lstrlenW (lpString=".pdf") returned 4 [0266.804] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString=".xls") returned 4 [0266.804] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0266.804] lstrlenW (lpString=".xlsx") returned 5 [0266.804] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0266.804] lstrlenW (lpString=".ppt") returned 4 [0266.805] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0266.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.805] lstrlenW (lpString=".zip") returned 4 [0266.805] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0266.805] lstrlenW (lpString=".rar") returned 4 [0266.805] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0266.805] lstrlenW (lpString=".bz2") returned 4 [0266.805] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0266.805] lstrlenW (lpString=".7z") returned 3 [0266.805] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0266.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.805] lstrlenW (lpString=".dbf") returned 4 [0266.805] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0266.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.805] lstrlenW (lpString=".1cd") returned 4 [0266.805] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0266.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0266.805] lstrlenW (lpString=".jpg") returned 4 [0266.805] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0266.805] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0266.805] lstrlenW (lpString="WordMUI.msi") returned 11 [0266.805] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0266.805] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=2522624) returned 1 [0266.805] CloseHandle (hObject=0x18c) returned 1 [0266.806] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0266.806] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.806] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0266.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0266.808] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0266.808] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0266.808] ReadFile (in: hFile=0x18c, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0266.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0266.889] ReadFile (in: hFile=0x18c, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0266.923] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0266.923] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0266.923] ReadFile (in: hFile=0x18c, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0267.139] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.139] WriteFile (in: hFile=0x18c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0267.157] SetEndOfFile (hFile=0x18c) returned 1 [0267.157] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0267.162] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.162] WriteFile (in: hFile=0x18c, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.164] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.164] WriteFile (in: hFile=0x18c, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.618] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.618] WriteFile (in: hFile=0x18c, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.621] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0267.624] CloseHandle (hObject=0x18c) returned 1 [0267.938] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0267.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.938] lstrlenW (lpString=".doc") returned 4 [0267.938] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0267.939] lstrlenW (lpString=".docx") returned 5 [0267.939] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0267.939] lstrlenW (lpString=".pdf") returned 4 [0267.939] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0267.939] lstrlenW (lpString=".xls") returned 4 [0267.939] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0267.939] lstrlenW (lpString=".xlsx") returned 5 [0267.939] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0267.939] lstrlenW (lpString=".ppt") returned 4 [0267.939] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0267.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.939] lstrlenW (lpString=".zip") returned 4 [0267.939] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0267.939] lstrlenW (lpString=".rar") returned 4 [0267.939] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0267.939] lstrlenW (lpString=".bz2") returned 4 [0267.939] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0267.939] lstrlenW (lpString=".7z") returned 3 [0267.939] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0267.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.939] lstrlenW (lpString=".dbf") returned 4 [0267.939] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0267.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.939] lstrlenW (lpString=".1cd") returned 4 [0267.939] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0267.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.940] lstrlenW (lpString=".jpg") returned 4 [0267.940] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0267.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.940] lstrlenW (lpString=".doc") returned 4 [0267.940] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0267.940] lstrlenW (lpString=".docx") returned 5 [0267.940] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0267.940] lstrlenW (lpString=".pdf") returned 4 [0267.941] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0267.941] lstrlenW (lpString=".xls") returned 4 [0267.941] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0267.941] lstrlenW (lpString=".xlsx") returned 5 [0267.941] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0267.941] lstrlenW (lpString=".ppt") returned 4 [0267.941] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0267.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.941] lstrlenW (lpString=".zip") returned 4 [0267.941] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0267.941] lstrlenW (lpString=".rar") returned 4 [0267.941] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0267.941] lstrlenW (lpString=".bz2") returned 4 [0267.941] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0267.941] lstrlenW (lpString=".7z") returned 3 [0267.942] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0267.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.942] lstrlenW (lpString=".dbf") returned 4 [0267.942] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0267.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.942] lstrlenW (lpString=".1cd") returned 4 [0267.942] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0267.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0267.942] lstrlenW (lpString=".jpg") returned 4 [0267.942] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0267.942] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0267.942] lstrlenW (lpString="Proof.cab") returned 9 [0267.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0268.000] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=13642474) returned 1 [0268.001] CloseHandle (hObject=0x1ec) returned 1 [0268.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0268.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.001] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0268.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0268.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0268.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0268.418] ReadFile (in: hFile=0x1ec, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0268.489] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0268.489] ReadFile (in: hFile=0x1ec, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0268.540] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0268.540] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0268.540] ReadFile (in: hFile=0x1ec, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0268.581] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.581] WriteFile (in: hFile=0x1ec, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0268.795] SetEndOfFile (hFile=0x1ec) returned 1 [0268.875] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0268.881] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0268.881] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0268.884] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0268.884] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0268.885] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0268.885] WriteFile (in: hFile=0x1ec, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0268.886] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0268.886] CloseHandle (hObject=0x1ec) returned 1 [0270.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0270.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.856] lstrlenW (lpString=".doc") returned 4 [0270.856] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0270.856] lstrlenW (lpString=".docx") returned 5 [0270.856] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0270.856] lstrlenW (lpString=".pdf") returned 4 [0270.856] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0270.856] lstrlenW (lpString=".xls") returned 4 [0270.856] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0270.856] lstrlenW (lpString=".xlsx") returned 5 [0270.856] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0270.856] lstrlenW (lpString=".ppt") returned 4 [0270.856] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0270.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.856] lstrlenW (lpString=".zip") returned 4 [0270.856] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0270.856] lstrlenW (lpString=".rar") returned 4 [0270.856] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0270.856] lstrlenW (lpString=".bz2") returned 4 [0270.856] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0270.856] lstrlenW (lpString=".7z") returned 3 [0270.856] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0270.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.856] lstrlenW (lpString=".dbf") returned 4 [0270.856] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.857] lstrlenW (lpString=".1cd") returned 4 [0270.857] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0270.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.857] lstrlenW (lpString=".jpg") returned 4 [0270.857] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.857] lstrlenW (lpString=".doc") returned 4 [0270.857] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString=".docx") returned 5 [0270.857] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0270.857] lstrlenW (lpString=".pdf") returned 4 [0270.857] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString=".xls") returned 4 [0270.857] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString=".xlsx") returned 5 [0270.857] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0270.857] lstrlenW (lpString=".ppt") returned 4 [0270.857] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.857] lstrlenW (lpString=".zip") returned 4 [0270.857] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString=".rar") returned 4 [0270.857] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0270.857] lstrlenW (lpString=".bz2") returned 4 [0270.857] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0270.858] lstrlenW (lpString=".7z") returned 3 [0270.858] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0270.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.858] lstrlenW (lpString=".dbf") returned 4 [0270.858] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0270.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.858] lstrlenW (lpString=".1cd") returned 4 [0270.858] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0270.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0270.858] lstrlenW (lpString=".jpg") returned 4 [0270.858] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0270.858] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0270.858] lstrlenW (lpString="InfLR.cab") returned 9 [0270.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0270.859] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=18874884) returned 1 [0270.859] CloseHandle (hObject=0x1ec) returned 1 [0270.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0270.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.859] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0270.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0270.860] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0270.860] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0270.860] ReadFile (in: hFile=0x1ec, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.086] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.086] ReadFile (in: hFile=0x1ec, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.108] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0271.108] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.108] ReadFile (in: hFile=0x1ec, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.171] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.171] WriteFile (in: hFile=0x1ec, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0271.183] SetEndOfFile (hFile=0x1ec) returned 1 [0271.183] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x40248e8 [0271.187] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0271.187] WriteFile (in: hFile=0x1ec, lpBuffer=0x40248e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40248e8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.189] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0271.189] WriteFile (in: hFile=0x1ec, lpBuffer=0x40248e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40248e8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.367] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0271.367] WriteFile (in: hFile=0x1ec, lpBuffer=0x40248e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40248e8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.371] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x40248e8 | out: hHeap=0x2e0000) returned 1 [0271.374] CloseHandle (hObject=0x1ec) returned 1 [0271.810] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0271.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.810] lstrlenW (lpString=".doc") returned 4 [0271.810] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0271.810] lstrlenW (lpString=".docx") returned 5 [0271.810] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0271.810] lstrlenW (lpString=".pdf") returned 4 [0271.811] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString=".xls") returned 4 [0271.811] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString=".xlsx") returned 5 [0271.811] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0271.811] lstrlenW (lpString=".ppt") returned 4 [0271.811] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.811] lstrlenW (lpString=".zip") returned 4 [0271.811] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString=".rar") returned 4 [0271.811] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString=".bz2") returned 4 [0271.811] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0271.811] lstrlenW (lpString=".7z") returned 3 [0271.811] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0271.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.811] lstrlenW (lpString=".dbf") returned 4 [0271.811] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.811] lstrlenW (lpString=".1cd") returned 4 [0271.811] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0271.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.811] lstrlenW (lpString=".jpg") returned 4 [0271.811] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.811] lstrlenW (lpString=".doc") returned 4 [0271.811] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0271.811] lstrlenW (lpString=".docx") returned 5 [0271.812] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0271.812] lstrlenW (lpString=".pdf") returned 4 [0271.812] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0271.812] lstrlenW (lpString=".xls") returned 4 [0271.812] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0271.812] lstrlenW (lpString=".xlsx") returned 5 [0271.812] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0271.812] lstrlenW (lpString=".ppt") returned 4 [0271.812] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0271.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.812] lstrlenW (lpString=".zip") returned 4 [0271.812] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0271.812] lstrlenW (lpString=".rar") returned 4 [0271.812] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0271.812] lstrlenW (lpString=".bz2") returned 4 [0271.812] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0271.812] lstrlenW (lpString=".7z") returned 3 [0271.812] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0271.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.812] lstrlenW (lpString=".dbf") returned 4 [0271.812] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0271.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.812] lstrlenW (lpString=".1cd") returned 4 [0271.812] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0271.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0271.812] lstrlenW (lpString=".jpg") returned 4 [0271.812] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0271.813] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0271.813] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0271.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0271.813] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=2503680) returned 1 [0271.813] CloseHandle (hObject=0x1e4) returned 1 [0271.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0271.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.813] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0271.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0271.814] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0271.814] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.814] ReadFile (in: hFile=0x1e4, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.102] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0272.102] ReadFile (in: hFile=0x1e4, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.355] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0272.355] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0272.355] ReadFile (in: hFile=0x1e4, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.376] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.376] WriteFile (in: hFile=0x1e4, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0272.490] SetEndOfFile (hFile=0x1e4) returned 1 [0272.490] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0272.490] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0272.490] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0272.492] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0272.492] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0272.497] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0272.497] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0272.500] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0272.500] CloseHandle (hObject=0x1e4) returned 1 [0272.500] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0272.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.501] lstrlenW (lpString=".doc") returned 4 [0272.501] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0272.501] lstrlenW (lpString=".docx") returned 5 [0272.501] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0272.501] lstrlenW (lpString=".pdf") returned 4 [0272.501] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0272.501] lstrlenW (lpString=".xls") returned 4 [0272.501] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0272.501] lstrlenW (lpString=".xlsx") returned 5 [0272.501] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0272.501] lstrlenW (lpString=".ppt") returned 4 [0272.501] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0272.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.501] lstrlenW (lpString=".zip") returned 4 [0272.501] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0272.501] lstrlenW (lpString=".rar") returned 4 [0272.501] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0272.501] lstrlenW (lpString=".bz2") returned 4 [0272.501] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0272.501] lstrlenW (lpString=".7z") returned 3 [0272.501] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0272.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.501] lstrlenW (lpString=".dbf") returned 4 [0272.501] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0272.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.501] lstrlenW (lpString=".1cd") returned 4 [0272.501] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0272.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.501] lstrlenW (lpString=".jpg") returned 4 [0272.502] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0272.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.502] lstrlenW (lpString=".doc") returned 4 [0272.502] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0272.502] lstrlenW (lpString=".docx") returned 5 [0272.502] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0272.502] lstrlenW (lpString=".pdf") returned 4 [0272.502] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0272.502] lstrlenW (lpString=".xls") returned 4 [0272.502] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0272.502] lstrlenW (lpString=".xlsx") returned 5 [0272.502] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0272.502] lstrlenW (lpString=".ppt") returned 4 [0272.502] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0272.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.502] lstrlenW (lpString=".zip") returned 4 [0272.502] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0272.502] lstrlenW (lpString=".rar") returned 4 [0272.502] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0272.502] lstrlenW (lpString=".bz2") returned 4 [0272.502] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0272.502] lstrlenW (lpString=".7z") returned 3 [0272.502] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0272.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.502] lstrlenW (lpString=".dbf") returned 4 [0272.502] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0272.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.502] lstrlenW (lpString=".1cd") returned 4 [0272.502] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0272.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0272.502] lstrlenW (lpString=".jpg") returned 4 [0272.502] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0272.503] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0272.503] lstrlenW (lpString="ProjLR.cab") returned 10 [0272.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0272.517] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=8265165) returned 1 [0272.517] CloseHandle (hObject=0x1e4) returned 1 [0272.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0272.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0272.518] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0272.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0272.518] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0272.518] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0272.518] ReadFile (in: hFile=0x1e4, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.619] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0272.619] ReadFile (in: hFile=0x1e4, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0277.702] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0277.702] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0277.702] ReadFile (in: hFile=0x1e4, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0277.939] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.939] WriteFile (in: hFile=0x1e4, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0278.191] SetEndOfFile (hFile=0x1e4) returned 1 [0278.191] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0278.191] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.191] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.193] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.193] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.195] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.195] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.198] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0278.198] CloseHandle (hObject=0x1e4) returned 1 [0278.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.315] lstrlenW (lpString=".doc") returned 4 [0278.315] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.315] lstrlenW (lpString=".docx") returned 5 [0278.315] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.315] lstrlenW (lpString=".pdf") returned 4 [0278.315] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.315] lstrlenW (lpString=".xls") returned 4 [0278.315] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.315] lstrlenW (lpString=".xlsx") returned 5 [0278.315] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.315] lstrlenW (lpString=".ppt") returned 4 [0278.315] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.315] lstrlenW (lpString=".zip") returned 4 [0278.315] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.315] lstrlenW (lpString=".rar") returned 4 [0278.315] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.315] lstrlenW (lpString=".bz2") returned 4 [0278.316] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.316] lstrlenW (lpString=".7z") returned 3 [0278.316] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.316] lstrlenW (lpString=".dbf") returned 4 [0278.316] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.316] lstrlenW (lpString=".1cd") returned 4 [0278.316] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.316] lstrlenW (lpString=".jpg") returned 4 [0278.316] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.316] lstrlenW (lpString=".doc") returned 4 [0278.316] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.316] lstrlenW (lpString=".docx") returned 5 [0278.316] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.316] lstrlenW (lpString=".pdf") returned 4 [0278.316] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.316] lstrlenW (lpString=".xls") returned 4 [0278.316] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.316] lstrlenW (lpString=".xlsx") returned 5 [0278.316] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.316] lstrlenW (lpString=".ppt") returned 4 [0278.316] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.316] lstrlenW (lpString=".zip") returned 4 [0278.316] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.317] lstrlenW (lpString=".rar") returned 4 [0278.317] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.317] lstrlenW (lpString=".bz2") returned 4 [0278.317] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.317] lstrlenW (lpString=".7z") returned 3 [0278.317] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.317] lstrlenW (lpString=".dbf") returned 4 [0278.317] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.317] lstrlenW (lpString=".1cd") returned 4 [0278.317] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0278.317] lstrlenW (lpString=".jpg") returned 4 [0278.317] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.317] lstrcmpiW (lpString1=".MST", lpString2=".drweb") returned 1 [0278.318] lstrlenW (lpString="ShellUI.MST") returned 11 [0278.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0278.318] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=3584) returned 1 [0278.318] CloseHandle (hObject=0x1c4) returned 1 [0278.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0278.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0278.319] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.319] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0278.319] GetLastError () returned 0x0 [0278.319] ReadFile (in: hFile=0x1c4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xe00, lpOverlapped=0x0) returned 1 [0278.403] WriteFile (in: hFile=0x1e4, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0278.404] ReadFile (in: hFile=0x1c4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.404] WriteFile (in: hFile=0x1e4, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.404] SetEndOfFile (hFile=0x1e4) returned 1 [0278.404] CloseHandle (hObject=0x1e4) returned 1 [0278.405] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.405] SetEndOfFile (hFile=0x1c4) returned 1 [0278.406] CloseHandle (hObject=0x1c4) returned 1 [0278.406] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.407] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0278.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.407] lstrlenW (lpString=".doc") returned 4 [0278.407] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0278.407] lstrlenW (lpString=".docx") returned 5 [0278.407] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0278.408] lstrlenW (lpString=".pdf") returned 4 [0278.408] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0278.408] lstrlenW (lpString=".xls") returned 4 [0278.408] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0278.408] lstrlenW (lpString=".xlsx") returned 5 [0278.408] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0278.408] lstrlenW (lpString=".ppt") returned 4 [0278.408] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0278.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.408] lstrlenW (lpString=".zip") returned 4 [0278.408] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0278.408] lstrlenW (lpString=".rar") returned 4 [0278.408] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0278.408] lstrlenW (lpString=".bz2") returned 4 [0278.408] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0278.408] lstrlenW (lpString=".7z") returned 3 [0278.408] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0278.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.408] lstrlenW (lpString=".dbf") returned 4 [0278.408] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0278.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.408] lstrlenW (lpString=".1cd") returned 4 [0278.409] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0278.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.409] lstrlenW (lpString=".jpg") returned 4 [0278.409] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0278.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.409] lstrlenW (lpString=".doc") returned 4 [0278.409] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0278.409] lstrlenW (lpString=".docx") returned 5 [0278.409] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0278.409] lstrlenW (lpString=".pdf") returned 4 [0278.409] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0278.409] lstrlenW (lpString=".xls") returned 4 [0278.409] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0278.409] lstrlenW (lpString=".xlsx") returned 5 [0278.409] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0278.409] lstrlenW (lpString=".ppt") returned 4 [0278.409] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0278.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.410] lstrlenW (lpString=".zip") returned 4 [0278.410] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0278.410] lstrlenW (lpString=".rar") returned 4 [0278.410] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0278.410] lstrlenW (lpString=".bz2") returned 4 [0278.410] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0278.410] lstrlenW (lpString=".7z") returned 3 [0278.410] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0278.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.411] lstrlenW (lpString=".dbf") returned 4 [0278.411] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0278.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.411] lstrlenW (lpString=".1cd") returned 4 [0278.411] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0278.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0278.411] lstrlenW (lpString=".jpg") returned 4 [0278.411] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0278.411] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0278.411] lstrlenW (lpString="AccessMUI.msi") returned 13 [0278.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0278.476] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=2517504) returned 1 [0278.476] CloseHandle (hObject=0x204) returned 1 [0278.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0278.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.477] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0278.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0278.478] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0278.479] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.479] ReadFile (in: hFile=0x204, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.545] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.545] ReadFile (in: hFile=0x204, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.615] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0278.615] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.615] ReadFile (in: hFile=0x204, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.795] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.795] WriteFile (in: hFile=0x204, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0278.815] SetEndOfFile (hFile=0x204) returned 1 [0278.815] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0278.819] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.819] WriteFile (in: hFile=0x204, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.821] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.821] WriteFile (in: hFile=0x204, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.145] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0279.145] WriteFile (in: hFile=0x204, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.148] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0279.302] CloseHandle (hObject=0x204) returned 1 [0279.302] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.303] lstrlenW (lpString=".doc") returned 4 [0279.303] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.303] lstrlenW (lpString=".docx") returned 5 [0279.303] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0279.303] lstrlenW (lpString=".pdf") returned 4 [0279.303] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.303] lstrlenW (lpString=".xls") returned 4 [0279.303] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.303] lstrlenW (lpString=".xlsx") returned 5 [0279.303] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0279.303] lstrlenW (lpString=".ppt") returned 4 [0279.303] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.303] lstrlenW (lpString=".zip") returned 4 [0279.303] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.303] lstrlenW (lpString=".rar") returned 4 [0279.303] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.303] lstrlenW (lpString=".bz2") returned 4 [0279.303] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.303] lstrlenW (lpString=".7z") returned 3 [0279.303] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.304] lstrlenW (lpString=".dbf") returned 4 [0279.304] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.304] lstrlenW (lpString=".1cd") returned 4 [0279.304] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.304] lstrlenW (lpString=".jpg") returned 4 [0279.304] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.304] lstrlenW (lpString=".doc") returned 4 [0279.304] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.304] lstrlenW (lpString=".docx") returned 5 [0279.304] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0279.304] lstrlenW (lpString=".pdf") returned 4 [0279.304] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.304] lstrlenW (lpString=".xls") returned 4 [0279.304] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.304] lstrlenW (lpString=".xlsx") returned 5 [0279.304] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0279.304] lstrlenW (lpString=".ppt") returned 4 [0279.304] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.304] lstrlenW (lpString=".zip") returned 4 [0279.304] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.304] lstrlenW (lpString=".rar") returned 4 [0279.305] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.305] lstrlenW (lpString=".bz2") returned 4 [0279.305] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.305] lstrlenW (lpString=".7z") returned 3 [0279.305] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.305] lstrlenW (lpString=".dbf") returned 4 [0279.305] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.305] lstrlenW (lpString=".1cd") returned 4 [0279.305] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0279.305] lstrlenW (lpString=".jpg") returned 4 [0279.305] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.305] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0279.305] lstrlenW (lpString="PidGenX.dll") returned 11 [0279.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0279.306] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=1463568) returned 1 [0279.306] CloseHandle (hObject=0x204) returned 1 [0279.306] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0279.306] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0279.306] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.306] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0279.307] GetLastError () returned 0x0 [0279.307] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0279.469] WriteFile (in: hFile=0x174, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0279.603] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x65520, lpOverlapped=0x0) returned 1 [0279.617] WriteFile (in: hFile=0x174, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0279.629] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.629] WriteFile (in: hFile=0x174, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.629] SetEndOfFile (hFile=0x174) returned 1 [0279.629] CloseHandle (hObject=0x174) returned 1 [0279.629] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.629] SetEndOfFile (hFile=0x204) returned 1 [0279.633] CloseHandle (hObject=0x204) returned 1 [0279.633] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.720] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0279.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.721] lstrlenW (lpString=".doc") returned 4 [0279.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".docx") returned 5 [0279.721] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0279.721] lstrlenW (lpString=".pdf") returned 4 [0279.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".xls") returned 4 [0279.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".xlsx") returned 5 [0279.721] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0279.721] lstrlenW (lpString=".ppt") returned 4 [0279.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.721] lstrlenW (lpString=".zip") returned 4 [0279.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".rar") returned 4 [0279.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.721] lstrlenW (lpString=".bz2") returned 4 [0279.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.721] lstrlenW (lpString=".7z") returned 3 [0279.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.721] lstrlenW (lpString=".dbf") returned 4 [0279.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.721] lstrlenW (lpString=".1cd") returned 4 [0279.721] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.722] lstrlenW (lpString=".jpg") returned 4 [0279.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.722] lstrlenW (lpString=".doc") returned 4 [0279.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".docx") returned 5 [0279.722] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0279.722] lstrlenW (lpString=".pdf") returned 4 [0279.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".xls") returned 4 [0279.722] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".xlsx") returned 5 [0279.722] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0279.722] lstrlenW (lpString=".ppt") returned 4 [0279.722] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.722] lstrlenW (lpString=".zip") returned 4 [0279.722] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".rar") returned 4 [0279.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.722] lstrlenW (lpString=".bz2") returned 4 [0279.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.722] lstrlenW (lpString=".7z") returned 3 [0279.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.723] lstrlenW (lpString=".dbf") returned 4 [0279.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.723] lstrlenW (lpString=".1cd") returned 4 [0279.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0279.723] lstrlenW (lpString=".jpg") returned 4 [0279.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.723] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0279.723] lstrlenW (lpString="setup.exe") returned 9 [0279.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0279.724] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=1377656) returned 1 [0279.724] CloseHandle (hObject=0x204) returned 1 [0279.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0279.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0279.724] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.724] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0279.725] GetLastError () returned 0x0 [0279.725] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0280.211] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0280.237] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x50588, lpOverlapped=0x0) returned 1 [0280.252] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0280.263] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.263] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0280.263] SetEndOfFile (hFile=0x1b0) returned 1 [0280.263] CloseHandle (hObject=0x1b0) returned 1 [0280.263] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.263] SetEndOfFile (hFile=0x204) returned 1 [0280.267] CloseHandle (hObject=0x204) returned 1 [0280.267] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0280.267] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0280.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.268] lstrlenW (lpString=".doc") returned 4 [0280.268] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0280.268] lstrlenW (lpString=".docx") returned 5 [0280.268] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0280.268] lstrlenW (lpString=".pdf") returned 4 [0280.268] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0280.268] lstrlenW (lpString=".xls") returned 4 [0280.268] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0280.268] lstrlenW (lpString=".xlsx") returned 5 [0280.268] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0280.268] lstrlenW (lpString=".ppt") returned 4 [0280.268] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0280.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.268] lstrlenW (lpString=".zip") returned 4 [0280.268] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0280.268] lstrlenW (lpString=".rar") returned 4 [0280.268] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0280.268] lstrlenW (lpString=".bz2") returned 4 [0280.268] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0280.268] lstrlenW (lpString=".7z") returned 3 [0280.268] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0280.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.268] lstrlenW (lpString=".dbf") returned 4 [0280.268] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0280.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.268] lstrlenW (lpString=".1cd") returned 4 [0280.268] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0280.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.269] lstrlenW (lpString=".jpg") returned 4 [0280.269] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0280.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.269] lstrlenW (lpString=".doc") returned 4 [0280.269] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0280.269] lstrlenW (lpString=".docx") returned 5 [0280.269] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0280.269] lstrlenW (lpString=".pdf") returned 4 [0280.269] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0280.269] lstrlenW (lpString=".xls") returned 4 [0280.269] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0280.269] lstrlenW (lpString=".xlsx") returned 5 [0280.269] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0280.269] lstrlenW (lpString=".ppt") returned 4 [0280.269] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0280.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.269] lstrlenW (lpString=".zip") returned 4 [0280.269] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0280.269] lstrlenW (lpString=".rar") returned 4 [0280.269] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0280.269] lstrlenW (lpString=".bz2") returned 4 [0280.269] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0280.269] lstrlenW (lpString=".7z") returned 3 [0280.269] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0280.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.269] lstrlenW (lpString=".dbf") returned 4 [0280.269] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0280.269] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.270] lstrlenW (lpString=".1cd") returned 4 [0280.270] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0280.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0280.270] lstrlenW (lpString=".jpg") returned 4 [0280.270] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0280.270] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0280.270] lstrlenW (lpString="ose.exe") returned 7 [0280.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0280.337] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=174440) returned 1 [0280.337] CloseHandle (hObject=0x1b0) returned 1 [0280.337] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0280.337] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0280.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0280.337] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.337] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.337] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0280.338] GetLastError () returned 0x0 [0280.338] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0280.370] WriteFile (in: hFile=0x214, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0280.374] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.374] WriteFile (in: hFile=0x214, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0280.374] SetEndOfFile (hFile=0x214) returned 1 [0280.374] CloseHandle (hObject=0x214) returned 1 [0280.374] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.374] SetEndOfFile (hFile=0x1b0) returned 1 [0280.376] CloseHandle (hObject=0x1b0) returned 1 [0280.376] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0280.377] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0280.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.377] lstrlenW (lpString=".doc") returned 4 [0280.377] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0280.377] lstrlenW (lpString=".docx") returned 5 [0280.377] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0280.377] lstrlenW (lpString=".pdf") returned 4 [0280.377] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0280.377] lstrlenW (lpString=".xls") returned 4 [0280.377] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0280.377] lstrlenW (lpString=".xlsx") returned 5 [0280.377] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0280.377] lstrlenW (lpString=".ppt") returned 4 [0280.377] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0280.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.377] lstrlenW (lpString=".zip") returned 4 [0280.377] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0280.377] lstrlenW (lpString=".rar") returned 4 [0280.377] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0280.377] lstrlenW (lpString=".bz2") returned 4 [0280.377] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0280.378] lstrlenW (lpString=".7z") returned 3 [0280.378] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0280.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.378] lstrlenW (lpString=".dbf") returned 4 [0280.378] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0280.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.378] lstrlenW (lpString=".1cd") returned 4 [0280.378] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0280.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.378] lstrlenW (lpString=".jpg") returned 4 [0280.378] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0280.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.378] lstrlenW (lpString=".doc") returned 4 [0280.378] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0280.378] lstrlenW (lpString=".docx") returned 5 [0280.378] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0280.378] lstrlenW (lpString=".pdf") returned 4 [0280.378] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0280.378] lstrlenW (lpString=".xls") returned 4 [0280.378] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0280.378] lstrlenW (lpString=".xlsx") returned 5 [0280.378] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0280.378] lstrlenW (lpString=".ppt") returned 4 [0280.378] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0280.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.378] lstrlenW (lpString=".zip") returned 4 [0280.378] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0280.379] lstrlenW (lpString=".rar") returned 4 [0280.379] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0280.379] lstrlenW (lpString=".bz2") returned 4 [0280.379] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0280.379] lstrlenW (lpString=".7z") returned 3 [0280.379] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0280.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.379] lstrlenW (lpString=".dbf") returned 4 [0280.379] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0280.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.379] lstrlenW (lpString=".1cd") returned 4 [0280.379] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0280.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0280.379] lstrlenW (lpString=".jpg") returned 4 [0280.379] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0280.379] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0280.379] lstrlenW (lpString="osetup.dll") returned 10 [0280.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0280.380] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=7378792) returned 1 [0280.380] CloseHandle (hObject=0x1b0) returned 1 [0280.380] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0280.380] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0280.380] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0280.380] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0280.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0280.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0280.381] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.337] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0281.337] ReadFile (in: hFile=0x1b0, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.420] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0281.420] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0281.420] ReadFile (in: hFile=0x1b0, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.780] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.780] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0282.010] SetEndOfFile (hFile=0x1b0) returned 1 [0282.010] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3ff48e8 [0282.175] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0282.175] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ff48e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff48e8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.177] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0282.177] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ff48e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff48e8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.179] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0282.179] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ff48e8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ff48e8*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.181] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ff48e8 | out: hHeap=0x2e0000) returned 1 [0282.181] CloseHandle (hObject=0x1b0) returned 1 [0282.181] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0282.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.181] lstrlenW (lpString=".doc") returned 4 [0282.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.181] lstrlenW (lpString=".docx") returned 5 [0282.181] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0282.181] lstrlenW (lpString=".pdf") returned 4 [0282.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.181] lstrlenW (lpString=".xls") returned 4 [0282.182] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.182] lstrlenW (lpString=".xlsx") returned 5 [0282.182] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0282.182] lstrlenW (lpString=".ppt") returned 4 [0282.182] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.182] lstrlenW (lpString=".zip") returned 4 [0282.182] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.182] lstrlenW (lpString=".rar") returned 4 [0282.182] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.182] lstrlenW (lpString=".bz2") returned 4 [0282.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.182] lstrlenW (lpString=".7z") returned 3 [0282.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.182] lstrlenW (lpString=".dbf") returned 4 [0282.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.182] lstrlenW (lpString=".1cd") returned 4 [0282.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.182] lstrlenW (lpString=".jpg") returned 4 [0282.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.182] lstrlenW (lpString=".doc") returned 4 [0282.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.183] lstrlenW (lpString=".docx") returned 5 [0282.183] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0282.183] lstrlenW (lpString=".pdf") returned 4 [0282.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.183] lstrlenW (lpString=".xls") returned 4 [0282.183] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.183] lstrlenW (lpString=".xlsx") returned 5 [0282.183] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0282.183] lstrlenW (lpString=".ppt") returned 4 [0282.183] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.183] lstrlenW (lpString=".zip") returned 4 [0282.183] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.183] lstrlenW (lpString=".rar") returned 4 [0282.183] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.183] lstrlenW (lpString=".bz2") returned 4 [0282.183] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.183] lstrlenW (lpString=".7z") returned 3 [0282.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.183] lstrlenW (lpString=".dbf") returned 4 [0282.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.183] lstrlenW (lpString=".1cd") returned 4 [0282.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0282.183] lstrlenW (lpString=".jpg") returned 4 [0282.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.184] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0282.184] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0282.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.585] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=162970271) returned 1 [0282.585] CloseHandle (hObject=0x210) returned 1 [0282.585] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0282.585] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.585] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0282.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.586] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0282.586] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0282.586] ReadFile (in: hFile=0x210, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0282.696] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0282.696] ReadFile (in: hFile=0x210, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0282.930] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0282.930] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0282.930] ReadFile (in: hFile=0x210, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.024] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.024] WriteFile (in: hFile=0x210, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0283.144] SetEndOfFile (hFile=0x210) returned 1 [0283.144] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0283.144] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0283.144] WriteFile (in: hFile=0x210, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.145] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0283.145] WriteFile (in: hFile=0x210, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.148] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0283.148] WriteFile (in: hFile=0x210, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.150] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0283.150] CloseHandle (hObject=0x210) returned 1 [0283.150] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.151] lstrlenW (lpString=".doc") returned 4 [0283.151] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0283.151] lstrlenW (lpString=".docx") returned 5 [0283.151] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0283.151] lstrlenW (lpString=".pdf") returned 4 [0283.151] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0283.151] lstrlenW (lpString=".xls") returned 4 [0283.151] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0283.151] lstrlenW (lpString=".xlsx") returned 5 [0283.151] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0283.151] lstrlenW (lpString=".ppt") returned 4 [0283.151] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0283.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.151] lstrlenW (lpString=".zip") returned 4 [0283.151] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0283.151] lstrlenW (lpString=".rar") returned 4 [0283.151] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0283.151] lstrlenW (lpString=".bz2") returned 4 [0283.151] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0283.151] lstrlenW (lpString=".7z") returned 3 [0283.151] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0283.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.152] lstrlenW (lpString=".dbf") returned 4 [0283.152] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.152] lstrlenW (lpString=".1cd") returned 4 [0283.152] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0283.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.152] lstrlenW (lpString=".jpg") returned 4 [0283.152] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.152] lstrlenW (lpString=".doc") returned 4 [0283.152] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString=".docx") returned 5 [0283.152] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0283.152] lstrlenW (lpString=".pdf") returned 4 [0283.152] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString=".xls") returned 4 [0283.152] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString=".xlsx") returned 5 [0283.152] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0283.152] lstrlenW (lpString=".ppt") returned 4 [0283.152] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.152] lstrlenW (lpString=".zip") returned 4 [0283.152] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString=".rar") returned 4 [0283.152] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0283.152] lstrlenW (lpString=".bz2") returned 4 [0283.152] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0283.152] lstrlenW (lpString=".7z") returned 3 [0283.153] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0283.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.153] lstrlenW (lpString=".dbf") returned 4 [0283.153] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0283.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.153] lstrlenW (lpString=".1cd") returned 4 [0283.153] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0283.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0283.153] lstrlenW (lpString=".jpg") returned 4 [0283.153] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0283.153] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0283.153] lstrlenW (lpString="PidGenX.dll") returned 11 [0283.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0283.153] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=1463568) returned 1 [0283.153] CloseHandle (hObject=0x210) returned 1 [0283.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0283.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0283.154] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.154] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.154] GetLastError () returned 0x0 [0283.154] ReadFile (in: hFile=0x210, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0283.224] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0283.368] ReadFile (in: hFile=0x210, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x65520, lpOverlapped=0x0) returned 1 [0283.383] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0283.541] ReadFile (in: hFile=0x210, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0283.541] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0283.541] SetEndOfFile (hFile=0x1b0) returned 1 [0283.557] CloseHandle (hObject=0x1b0) returned 1 [0283.557] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.557] SetEndOfFile (hFile=0x210) returned 1 [0283.560] CloseHandle (hObject=0x210) returned 1 [0283.561] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.561] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0283.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.561] lstrlenW (lpString=".doc") returned 4 [0283.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.561] lstrlenW (lpString=".docx") returned 5 [0283.561] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0283.561] lstrlenW (lpString=".pdf") returned 4 [0283.561] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.561] lstrlenW (lpString=".xls") returned 4 [0283.561] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.561] lstrlenW (lpString=".xlsx") returned 5 [0283.561] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0283.561] lstrlenW (lpString=".ppt") returned 4 [0283.561] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.561] lstrlenW (lpString=".zip") returned 4 [0283.561] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.561] lstrlenW (lpString=".rar") returned 4 [0283.561] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.561] lstrlenW (lpString=".bz2") returned 4 [0283.562] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.562] lstrlenW (lpString=".7z") returned 3 [0283.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.562] lstrlenW (lpString=".dbf") returned 4 [0283.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.562] lstrlenW (lpString=".1cd") returned 4 [0283.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.562] lstrlenW (lpString=".jpg") returned 4 [0283.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.562] lstrlenW (lpString=".doc") returned 4 [0283.562] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString=".docx") returned 5 [0283.562] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0283.562] lstrlenW (lpString=".pdf") returned 4 [0283.562] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString=".xls") returned 4 [0283.562] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString=".xlsx") returned 5 [0283.562] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0283.562] lstrlenW (lpString=".ppt") returned 4 [0283.562] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.562] lstrlenW (lpString=".zip") returned 4 [0283.562] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString=".rar") returned 4 [0283.562] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.562] lstrlenW (lpString=".bz2") returned 4 [0283.562] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.562] lstrlenW (lpString=".7z") returned 3 [0283.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.563] lstrlenW (lpString=".dbf") returned 4 [0283.563] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.563] lstrlenW (lpString=".1cd") returned 4 [0283.563] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0283.563] lstrlenW (lpString=".jpg") returned 4 [0283.563] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.563] lstrcmpiW (lpString1=".sys", lpString2=".drweb") returned 1 [0283.563] lstrlenW (lpString="pagefile.sys") returned 12 [0283.563] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.563] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.563] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.563] lstrlenW (lpString=".doc") returned 4 [0283.563] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0283.563] lstrlenW (lpString=".docx") returned 5 [0283.563] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0283.563] lstrlenW (lpString=".pdf") returned 4 [0283.563] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0283.563] lstrlenW (lpString=".xls") returned 4 [0283.563] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0283.563] lstrlenW (lpString=".xlsx") returned 5 [0283.563] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0283.563] lstrlenW (lpString=".ppt") returned 4 [0283.563] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0283.563] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.563] lstrlenW (lpString=".zip") returned 4 [0283.563] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0283.563] lstrlenW (lpString=".rar") returned 4 [0283.564] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString=".bz2") returned 4 [0283.564] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString=".7z") returned 3 [0283.564] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0283.564] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.564] lstrlenW (lpString=".dbf") returned 4 [0283.564] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.564] lstrlenW (lpString=".1cd") returned 4 [0283.564] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.564] lstrlenW (lpString=".jpg") returned 4 [0283.564] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.564] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.564] lstrlenW (lpString=".doc") returned 4 [0283.564] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString=".docx") returned 5 [0283.564] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0283.564] lstrlenW (lpString=".pdf") returned 4 [0283.564] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString=".xls") returned 4 [0283.564] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0283.564] lstrlenW (lpString=".xlsx") returned 5 [0283.564] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0283.564] lstrlenW (lpString=".ppt") returned 4 [0283.564] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0283.564] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.565] lstrlenW (lpString=".zip") returned 4 [0283.565] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0283.565] lstrlenW (lpString=".rar") returned 4 [0283.565] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0283.565] lstrlenW (lpString=".bz2") returned 4 [0283.565] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0283.565] lstrlenW (lpString=".7z") returned 3 [0283.565] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0283.565] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.565] lstrlenW (lpString=".dbf") returned 4 [0283.565] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0283.565] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.565] lstrlenW (lpString=".1cd") returned 4 [0283.565] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0283.565] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0283.565] lstrlenW (lpString=".jpg") returned 4 [0283.565] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0283.565] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0283.565] lstrlenW (lpString="cet_passes_ul.exe") returned 17 [0283.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\cet_passes_ul.exe" (normalized: "c:\\program files\\common files\\cet_passes_ul.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0283.565] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=75776) returned 1 [0283.566] CloseHandle (hObject=0x210) returned 1 [0283.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\cet_passes_ul.exe" (normalized: "c:\\program files\\common files\\cet_passes_ul.exe")) returned 0x20 [0283.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\cet_passes_ul.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\cet_passes_ul.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\cet_passes_ul.exe" (normalized: "c:\\program files\\common files\\cet_passes_ul.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.566] lstrlenW (lpString=".doc") returned 4 [0283.566] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0283.566] lstrlenW (lpString=".docx") returned 5 [0283.566] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0283.566] lstrlenW (lpString=".pdf") returned 4 [0283.566] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0283.566] lstrlenW (lpString=".xls") returned 4 [0283.566] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0283.566] lstrlenW (lpString=".xlsx") returned 5 [0283.566] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0283.566] lstrlenW (lpString=".ppt") returned 4 [0283.566] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0283.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.566] lstrlenW (lpString=".zip") returned 4 [0283.566] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0283.566] lstrlenW (lpString=".rar") returned 4 [0283.566] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0283.566] lstrlenW (lpString=".bz2") returned 4 [0283.566] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0283.566] lstrlenW (lpString=".7z") returned 3 [0283.566] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString=".dbf") returned 4 [0283.567] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString=".1cd") returned 4 [0283.567] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString=".jpg") returned 4 [0283.567] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString=".doc") returned 4 [0283.567] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0283.567] lstrlenW (lpString=".docx") returned 5 [0283.567] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0283.567] lstrlenW (lpString=".pdf") returned 4 [0283.567] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0283.567] lstrlenW (lpString=".xls") returned 4 [0283.567] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0283.567] lstrlenW (lpString=".xlsx") returned 5 [0283.567] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0283.567] lstrlenW (lpString=".ppt") returned 4 [0283.567] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString=".zip") returned 4 [0283.567] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0283.567] lstrlenW (lpString=".rar") returned 4 [0283.567] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0283.567] lstrlenW (lpString=".bz2") returned 4 [0283.567] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0283.567] lstrlenW (lpString=".7z") returned 3 [0283.567] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0283.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.567] lstrlenW (lpString=".dbf") returned 4 [0283.567] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0283.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.568] lstrlenW (lpString=".1cd") returned 4 [0283.568] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0283.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\cet_passes_ul.exe") returned 47 [0283.568] lstrlenW (lpString=".jpg") returned 4 [0283.568] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0283.568] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0283.568] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0283.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.610] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=99136) returned 1 [0283.610] CloseHandle (hObject=0x180) returned 1 [0283.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0283.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.610] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.610] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0283.611] GetLastError () returned 0x0 [0283.611] ReadFile (in: hFile=0x180, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x18340, lpOverlapped=0x0) returned 1 [0283.614] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0283.616] ReadFile (in: hFile=0x180, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0283.616] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0283.616] SetEndOfFile (hFile=0x218) returned 1 [0283.616] CloseHandle (hObject=0x218) returned 1 [0283.616] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.616] SetEndOfFile (hFile=0x180) returned 1 [0283.617] CloseHandle (hObject=0x180) returned 1 [0283.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0283.618] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0283.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.618] lstrlenW (lpString=".doc") returned 4 [0283.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0283.618] lstrlenW (lpString=".docx") returned 5 [0283.618] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0283.618] lstrlenW (lpString=".pdf") returned 4 [0283.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0283.618] lstrlenW (lpString=".xls") returned 4 [0283.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0283.618] lstrlenW (lpString=".xlsx") returned 5 [0283.618] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0283.618] lstrlenW (lpString=".ppt") returned 4 [0283.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0283.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.618] lstrlenW (lpString=".zip") returned 4 [0283.618] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0283.618] lstrlenW (lpString=".rar") returned 4 [0283.618] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0283.618] lstrlenW (lpString=".bz2") returned 4 [0283.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0283.618] lstrlenW (lpString=".7z") returned 3 [0283.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0283.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.619] lstrlenW (lpString=".dbf") returned 4 [0283.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0283.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.619] lstrlenW (lpString=".1cd") returned 4 [0283.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0283.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.619] lstrlenW (lpString=".jpg") returned 4 [0283.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.619] lstrlenW (lpString=".doc") returned 4 [0283.619] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString=".docx") returned 5 [0283.619] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0283.619] lstrlenW (lpString=".pdf") returned 4 [0283.619] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString=".xls") returned 4 [0283.619] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString=".xlsx") returned 5 [0283.619] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0283.619] lstrlenW (lpString=".ppt") returned 4 [0283.619] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.619] lstrlenW (lpString=".zip") returned 4 [0283.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString=".rar") returned 4 [0283.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0283.619] lstrlenW (lpString=".bz2") returned 4 [0283.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0283.619] lstrlenW (lpString=".7z") returned 3 [0283.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0283.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.620] lstrlenW (lpString=".dbf") returned 4 [0283.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0283.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.620] lstrlenW (lpString=".1cd") returned 4 [0283.620] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0283.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0283.620] lstrlenW (lpString=".jpg") returned 4 [0283.620] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0283.620] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0283.620] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0283.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.621] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=1369952) returned 1 [0283.621] CloseHandle (hObject=0x180) returned 1 [0283.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0283.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.623] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.623] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0283.623] GetLastError () returned 0x0 [0283.623] ReadFile (in: hFile=0x180, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0283.646] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0283.664] ReadFile (in: hFile=0x180, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0283.723] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0283.739] ReadFile (in: hFile=0x180, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0283.739] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0283.739] SetEndOfFile (hFile=0x218) returned 1 [0283.740] CloseHandle (hObject=0x218) returned 1 [0283.740] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.740] SetEndOfFile (hFile=0x180) returned 1 [0283.743] CloseHandle (hObject=0x180) returned 1 [0283.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0283.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0283.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.744] lstrlenW (lpString=".doc") returned 4 [0283.744] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0283.744] lstrlenW (lpString=".docx") returned 5 [0283.744] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0283.744] lstrlenW (lpString=".pdf") returned 4 [0283.744] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0283.744] lstrlenW (lpString=".xls") returned 4 [0283.744] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0283.744] lstrlenW (lpString=".xlsx") returned 5 [0283.744] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0283.744] lstrlenW (lpString=".ppt") returned 4 [0283.744] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0283.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.744] lstrlenW (lpString=".zip") returned 4 [0283.744] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0283.744] lstrlenW (lpString=".rar") returned 4 [0283.744] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0283.744] lstrlenW (lpString=".bz2") returned 4 [0283.744] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0283.744] lstrlenW (lpString=".7z") returned 3 [0283.744] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0283.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.744] lstrlenW (lpString=".dbf") returned 4 [0283.744] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0283.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.744] lstrlenW (lpString=".1cd") returned 4 [0283.744] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0283.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.744] lstrlenW (lpString=".jpg") returned 4 [0283.745] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.745] lstrlenW (lpString=".doc") returned 4 [0283.745] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString=".docx") returned 5 [0283.745] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0283.745] lstrlenW (lpString=".pdf") returned 4 [0283.745] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString=".xls") returned 4 [0283.745] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString=".xlsx") returned 5 [0283.745] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0283.745] lstrlenW (lpString=".ppt") returned 4 [0283.745] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.745] lstrlenW (lpString=".zip") returned 4 [0283.745] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString=".rar") returned 4 [0283.745] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0283.745] lstrlenW (lpString=".bz2") returned 4 [0283.745] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0283.745] lstrlenW (lpString=".7z") returned 3 [0283.745] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0283.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.745] lstrlenW (lpString=".dbf") returned 4 [0283.745] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0283.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.745] lstrlenW (lpString=".1cd") returned 4 [0283.745] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0283.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0283.745] lstrlenW (lpString=".jpg") returned 4 [0283.746] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0283.746] lstrcmpiW (lpString1=".EXE", lpString2=".drweb") returned 1 [0283.746] lstrlenW (lpString="DW20.EXE") returned 8 [0283.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.875] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=994184) returned 1 [0283.875] CloseHandle (hObject=0x1b0) returned 1 [0283.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0283.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.875] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0283.875] GetLastError () returned 0x0 [0283.875] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0283.913] WriteFile (in: hFile=0x208, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0283.948] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0283.948] WriteFile (in: hFile=0x208, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0283.949] SetEndOfFile (hFile=0x208) returned 1 [0283.949] CloseHandle (hObject=0x208) returned 1 [0283.949] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.949] SetEndOfFile (hFile=0x1b0) returned 1 [0283.959] CloseHandle (hObject=0x1b0) returned 1 [0283.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0283.959] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0283.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.959] lstrlenW (lpString=".doc") returned 4 [0283.960] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0283.960] lstrlenW (lpString=".docx") returned 5 [0283.960] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0283.960] lstrlenW (lpString=".pdf") returned 4 [0283.960] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0283.960] lstrlenW (lpString=".xls") returned 4 [0283.960] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0283.960] lstrlenW (lpString=".xlsx") returned 5 [0283.960] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0283.960] lstrlenW (lpString=".ppt") returned 4 [0283.960] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0283.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.960] lstrlenW (lpString=".zip") returned 4 [0283.960] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0283.960] lstrlenW (lpString=".rar") returned 4 [0283.960] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0283.960] lstrlenW (lpString=".bz2") returned 4 [0283.960] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0283.960] lstrlenW (lpString=".7z") returned 3 [0283.960] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0283.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.960] lstrlenW (lpString=".dbf") returned 4 [0283.960] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0283.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.960] lstrlenW (lpString=".1cd") returned 4 [0283.960] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0283.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.960] lstrlenW (lpString=".jpg") returned 4 [0283.961] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0283.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.961] lstrlenW (lpString=".doc") returned 4 [0283.961] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0283.961] lstrlenW (lpString=".docx") returned 5 [0283.961] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0283.961] lstrlenW (lpString=".pdf") returned 4 [0283.961] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0283.961] lstrlenW (lpString=".xls") returned 4 [0283.961] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0283.961] lstrlenW (lpString=".xlsx") returned 5 [0283.961] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0283.961] lstrlenW (lpString=".ppt") returned 4 [0283.961] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0283.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.961] lstrlenW (lpString=".zip") returned 4 [0283.961] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0283.961] lstrlenW (lpString=".rar") returned 4 [0283.961] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0283.961] lstrlenW (lpString=".bz2") returned 4 [0283.961] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0283.961] lstrlenW (lpString=".7z") returned 3 [0283.961] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0283.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.961] lstrlenW (lpString=".dbf") returned 4 [0283.961] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0283.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.962] lstrlenW (lpString=".1cd") returned 4 [0283.962] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0283.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0283.962] lstrlenW (lpString=".jpg") returned 4 [0283.962] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0283.962] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0283.962] lstrlenW (lpString="EEINTL.DLL") returned 10 [0283.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.963] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=64096) returned 1 [0283.963] CloseHandle (hObject=0x1b0) returned 1 [0283.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0283.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.963] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.963] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0284.140] GetLastError () returned 0x0 [0284.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0284.145] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0284.149] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.149] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0284.149] SetEndOfFile (hFile=0x1f8) returned 1 [0284.150] CloseHandle (hObject=0x1f8) returned 1 [0284.150] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.150] SetEndOfFile (hFile=0x1b0) returned 1 [0284.151] CloseHandle (hObject=0x1b0) returned 1 [0284.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.152] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0284.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.152] lstrlenW (lpString=".doc") returned 4 [0284.152] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0284.152] lstrlenW (lpString=".docx") returned 5 [0284.152] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0284.152] lstrlenW (lpString=".pdf") returned 4 [0284.152] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0284.152] lstrlenW (lpString=".xls") returned 4 [0284.152] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0284.152] lstrlenW (lpString=".xlsx") returned 5 [0284.152] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0284.152] lstrlenW (lpString=".ppt") returned 4 [0284.152] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0284.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.152] lstrlenW (lpString=".zip") returned 4 [0284.152] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0284.152] lstrlenW (lpString=".rar") returned 4 [0284.152] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0284.153] lstrlenW (lpString=".bz2") returned 4 [0284.153] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0284.153] lstrlenW (lpString=".7z") returned 3 [0284.153] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0284.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.153] lstrlenW (lpString=".dbf") returned 4 [0284.153] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0284.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.153] lstrlenW (lpString=".1cd") returned 4 [0284.153] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0284.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.153] lstrlenW (lpString=".jpg") returned 4 [0284.153] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0284.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.153] lstrlenW (lpString=".doc") returned 4 [0284.153] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0284.153] lstrlenW (lpString=".docx") returned 5 [0284.153] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0284.153] lstrlenW (lpString=".pdf") returned 4 [0284.153] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0284.153] lstrlenW (lpString=".xls") returned 4 [0284.153] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0284.153] lstrlenW (lpString=".xlsx") returned 5 [0284.153] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0284.153] lstrlenW (lpString=".ppt") returned 4 [0284.153] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0284.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.154] lstrlenW (lpString=".zip") returned 4 [0284.154] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0284.154] lstrlenW (lpString=".rar") returned 4 [0284.154] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0284.154] lstrlenW (lpString=".bz2") returned 4 [0284.154] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0284.154] lstrlenW (lpString=".7z") returned 3 [0284.154] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0284.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.154] lstrlenW (lpString=".dbf") returned 4 [0284.154] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0284.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.154] lstrlenW (lpString=".1cd") returned 4 [0284.154] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0284.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0284.154] lstrlenW (lpString=".jpg") returned 4 [0284.154] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0284.154] lstrcmpiW (lpString1=".manifest", lpString2=".drweb") returned 1 [0284.154] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0284.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0284.156] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=566) returned 1 [0284.156] CloseHandle (hObject=0x1b0) returned 1 [0284.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0284.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0284.156] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.156] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0284.157] GetLastError () returned 0x0 [0284.157] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x236, lpOverlapped=0x0) returned 1 [0284.186] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x240, lpOverlapped=0x0) returned 1 [0284.187] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.187] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0284.187] SetEndOfFile (hFile=0x1f8) returned 1 [0284.187] CloseHandle (hObject=0x1f8) returned 1 [0284.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.187] SetEndOfFile (hFile=0x1b0) returned 1 [0284.188] CloseHandle (hObject=0x1b0) returned 1 [0284.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.189] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0284.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.189] lstrlenW (lpString=".doc") returned 4 [0284.189] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0284.189] lstrlenW (lpString=".docx") returned 5 [0284.189] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0284.189] lstrlenW (lpString=".pdf") returned 4 [0284.189] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0284.189] lstrlenW (lpString=".xls") returned 4 [0284.189] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0284.189] lstrlenW (lpString=".xlsx") returned 5 [0284.189] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0284.189] lstrlenW (lpString=".ppt") returned 4 [0284.189] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0284.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.189] lstrlenW (lpString=".zip") returned 4 [0284.189] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0284.189] lstrlenW (lpString=".rar") returned 4 [0284.189] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0284.189] lstrlenW (lpString=".bz2") returned 4 [0284.190] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".7z") returned 3 [0284.190] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0284.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.190] lstrlenW (lpString=".dbf") returned 4 [0284.190] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.190] lstrlenW (lpString=".1cd") returned 4 [0284.190] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.190] lstrlenW (lpString=".jpg") returned 4 [0284.190] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.190] lstrlenW (lpString=".doc") returned 4 [0284.190] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".docx") returned 5 [0284.190] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0284.190] lstrlenW (lpString=".pdf") returned 4 [0284.190] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".xls") returned 4 [0284.190] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".xlsx") returned 5 [0284.190] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0284.190] lstrlenW (lpString=".ppt") returned 4 [0284.190] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.190] lstrlenW (lpString=".zip") returned 4 [0284.190] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".rar") returned 4 [0284.190] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".bz2") returned 4 [0284.190] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0284.190] lstrlenW (lpString=".7z") returned 3 [0284.190] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0284.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.191] lstrlenW (lpString=".dbf") returned 4 [0284.191] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0284.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.191] lstrlenW (lpString=".1cd") returned 4 [0284.191] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0284.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0284.191] lstrlenW (lpString=".jpg") returned 4 [0284.191] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0284.191] lstrcmpiW (lpString1=".HLP", lpString2=".drweb") returned 1 [0284.191] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0284.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0284.192] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=176311) returned 1 [0284.192] CloseHandle (hObject=0x1b0) returned 1 [0284.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0284.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0284.192] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.192] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0284.193] GetLastError () returned 0x0 [0284.193] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0284.240] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0284.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.243] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0284.243] SetEndOfFile (hFile=0x1f8) returned 1 [0284.243] CloseHandle (hObject=0x1f8) returned 1 [0284.243] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.243] SetEndOfFile (hFile=0x1b0) returned 1 [0284.245] CloseHandle (hObject=0x1b0) returned 1 [0284.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0284.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.246] lstrlenW (lpString=".doc") returned 4 [0284.246] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0284.246] lstrlenW (lpString=".docx") returned 5 [0284.246] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0284.246] lstrlenW (lpString=".pdf") returned 4 [0284.246] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0284.246] lstrlenW (lpString=".xls") returned 4 [0284.246] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0284.246] lstrlenW (lpString=".xlsx") returned 5 [0284.246] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0284.246] lstrlenW (lpString=".ppt") returned 4 [0284.246] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0284.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.246] lstrlenW (lpString=".zip") returned 4 [0284.246] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0284.246] lstrlenW (lpString=".rar") returned 4 [0284.246] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0284.246] lstrlenW (lpString=".bz2") returned 4 [0284.246] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0284.246] lstrlenW (lpString=".7z") returned 3 [0284.246] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0284.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.246] lstrlenW (lpString=".dbf") returned 4 [0284.246] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0284.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.246] lstrlenW (lpString=".1cd") returned 4 [0284.246] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.247] lstrlenW (lpString=".jpg") returned 4 [0284.247] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.247] lstrlenW (lpString=".doc") returned 4 [0284.247] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0284.247] lstrlenW (lpString=".docx") returned 5 [0284.247] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0284.247] lstrlenW (lpString=".pdf") returned 4 [0284.247] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0284.247] lstrlenW (lpString=".xls") returned 4 [0284.247] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0284.247] lstrlenW (lpString=".xlsx") returned 5 [0284.247] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0284.247] lstrlenW (lpString=".ppt") returned 4 [0284.247] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.247] lstrlenW (lpString=".zip") returned 4 [0284.247] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0284.247] lstrlenW (lpString=".rar") returned 4 [0284.247] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0284.247] lstrlenW (lpString=".bz2") returned 4 [0284.247] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0284.247] lstrlenW (lpString=".7z") returned 3 [0284.247] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.247] lstrlenW (lpString=".dbf") returned 4 [0284.247] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.247] lstrlenW (lpString=".1cd") returned 4 [0284.247] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0284.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0284.248] lstrlenW (lpString=".jpg") returned 4 [0284.248] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0284.248] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0284.248] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0284.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0284.248] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=31104) returned 1 [0284.248] CloseHandle (hObject=0x1b0) returned 1 [0284.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0284.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0284.249] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.249] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0284.249] GetLastError () returned 0x0 [0284.249] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x7980, lpOverlapped=0x0) returned 1 [0284.360] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0284.361] ReadFile (in: hFile=0x1b0, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.361] WriteFile (in: hFile=0x1f8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0284.361] SetEndOfFile (hFile=0x1f8) returned 1 [0284.361] CloseHandle (hObject=0x1f8) returned 1 [0284.362] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.362] SetEndOfFile (hFile=0x1b0) returned 1 [0284.363] CloseHandle (hObject=0x1b0) returned 1 [0284.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.363] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0284.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.363] lstrlenW (lpString=".doc") returned 4 [0284.363] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0284.363] lstrlenW (lpString=".docx") returned 5 [0284.363] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0284.363] lstrlenW (lpString=".pdf") returned 4 [0284.363] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0284.363] lstrlenW (lpString=".xls") returned 4 [0284.363] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0284.363] lstrlenW (lpString=".xlsx") returned 5 [0284.363] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0284.363] lstrlenW (lpString=".ppt") returned 4 [0284.363] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0284.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.363] lstrlenW (lpString=".zip") returned 4 [0284.363] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0284.364] lstrlenW (lpString=".rar") returned 4 [0284.364] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0284.364] lstrlenW (lpString=".bz2") returned 4 [0284.364] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0284.364] lstrlenW (lpString=".7z") returned 3 [0284.364] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0284.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.364] lstrlenW (lpString=".dbf") returned 4 [0284.364] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0284.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.364] lstrlenW (lpString=".1cd") returned 4 [0284.364] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0284.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.364] lstrlenW (lpString=".jpg") returned 4 [0284.364] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0284.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.364] lstrlenW (lpString=".doc") returned 4 [0284.364] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0284.364] lstrlenW (lpString=".docx") returned 5 [0284.364] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0284.364] lstrlenW (lpString=".pdf") returned 4 [0284.364] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0284.364] lstrlenW (lpString=".xls") returned 4 [0284.364] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0284.377] lstrlenW (lpString=".xlsx") returned 5 [0284.377] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0284.377] lstrlenW (lpString=".ppt") returned 4 [0284.377] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0284.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.377] lstrlenW (lpString=".zip") returned 4 [0284.377] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0284.377] lstrlenW (lpString=".rar") returned 4 [0284.377] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0284.377] lstrlenW (lpString=".bz2") returned 4 [0284.377] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0284.377] lstrlenW (lpString=".7z") returned 3 [0284.377] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0284.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.377] lstrlenW (lpString=".dbf") returned 4 [0284.377] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0284.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.377] lstrlenW (lpString=".1cd") returned 4 [0284.377] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0284.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0284.377] lstrlenW (lpString=".jpg") returned 4 [0284.377] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0284.378] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0284.378] lstrlenW (lpString="VISFILT.DLL") returned 11 [0284.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0284.754] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=2124664) returned 1 [0284.754] CloseHandle (hObject=0x204) returned 1 [0284.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0284.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0284.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0284.776] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0x0) returned 1 [0284.798] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0284.798] ReadFile (in: hFile=0x204, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0284.800] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0284.800] ReadFile (in: hFile=0x204, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0284.803] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0284.803] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc2c | out: lpNewFilePointer=0x0) returned 1 [0284.803] ReadFile (in: hFile=0x204, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b4fc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2b4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0284.826] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.826] WriteFile (in: hFile=0x204, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0284.842] SetEndOfFile (hFile=0x204) returned 1 [0284.842] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0284.973] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0284.974] WriteFile (in: hFile=0x204, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.975] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0284.975] WriteFile (in: hFile=0x204, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.978] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fc7c | out: lpNewFilePointer=0x0) returned 1 [0284.978] WriteFile (in: hFile=0x204, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b4fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2b4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.979] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0284.979] CloseHandle (hObject=0x204) returned 1 [0284.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.980] lstrlenW (lpString=".doc") returned 4 [0284.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0284.980] lstrlenW (lpString=".docx") returned 5 [0284.980] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0284.980] lstrlenW (lpString=".pdf") returned 4 [0284.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0284.980] lstrlenW (lpString=".xls") returned 4 [0284.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0284.980] lstrlenW (lpString=".xlsx") returned 5 [0284.980] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0284.980] lstrlenW (lpString=".ppt") returned 4 [0284.980] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0284.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.981] lstrlenW (lpString=".zip") returned 4 [0284.981] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0284.981] lstrlenW (lpString=".rar") returned 4 [0284.981] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0284.981] lstrlenW (lpString=".bz2") returned 4 [0284.981] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0284.981] lstrlenW (lpString=".7z") returned 3 [0284.981] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.981] lstrlenW (lpString=".dbf") returned 4 [0284.981] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.981] lstrlenW (lpString=".1cd") returned 4 [0284.981] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.981] lstrlenW (lpString=".jpg") returned 4 [0284.981] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0284.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.981] lstrlenW (lpString=".doc") returned 4 [0284.981] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0284.981] lstrlenW (lpString=".docx") returned 5 [0284.981] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0284.981] lstrlenW (lpString=".pdf") returned 4 [0284.981] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0284.981] lstrlenW (lpString=".xls") returned 4 [0284.982] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0284.982] lstrlenW (lpString=".xlsx") returned 5 [0284.982] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0284.982] lstrlenW (lpString=".ppt") returned 4 [0284.982] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0284.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.982] lstrlenW (lpString=".zip") returned 4 [0284.982] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0284.982] lstrlenW (lpString=".rar") returned 4 [0284.982] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0284.982] lstrlenW (lpString=".bz2") returned 4 [0284.982] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0284.982] lstrlenW (lpString=".7z") returned 3 [0284.982] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0284.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.982] lstrlenW (lpString=".dbf") returned 4 [0284.982] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0284.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.982] lstrlenW (lpString=".1cd") returned 4 [0284.982] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0284.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0284.982] lstrlenW (lpString=".jpg") returned 4 [0284.982] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0284.983] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0284.983] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0284.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.493] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=320384) returned 1 [0285.493] CloseHandle (hObject=0x204) returned 1 [0285.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0285.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.493] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.493] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0285.494] GetLastError () returned 0x0 [0285.494] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0285.715] WriteFile (in: hFile=0x208, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0285.721] ReadFile (in: hFile=0x204, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.721] WriteFile (in: hFile=0x208, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.721] SetEndOfFile (hFile=0x208) returned 1 [0285.722] CloseHandle (hObject=0x208) returned 1 [0285.722] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.722] SetEndOfFile (hFile=0x204) returned 1 [0285.742] CloseHandle (hObject=0x204) returned 1 [0285.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0285.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.743] lstrlenW (lpString=".doc") returned 4 [0285.743] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.743] lstrlenW (lpString=".docx") returned 5 [0285.743] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.743] lstrlenW (lpString=".pdf") returned 4 [0285.743] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.743] lstrlenW (lpString=".xls") returned 4 [0285.743] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.743] lstrlenW (lpString=".xlsx") returned 5 [0285.743] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.744] lstrlenW (lpString=".ppt") returned 4 [0285.744] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.744] lstrlenW (lpString=".zip") returned 4 [0285.744] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.744] lstrlenW (lpString=".rar") returned 4 [0285.744] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.744] lstrlenW (lpString=".bz2") returned 4 [0285.744] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.744] lstrlenW (lpString=".7z") returned 3 [0285.744] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.744] lstrlenW (lpString=".dbf") returned 4 [0285.744] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.744] lstrlenW (lpString=".1cd") returned 4 [0285.744] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.744] lstrlenW (lpString=".jpg") returned 4 [0285.744] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.744] lstrlenW (lpString=".doc") returned 4 [0285.744] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.744] lstrlenW (lpString=".docx") returned 5 [0285.744] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.744] lstrlenW (lpString=".pdf") returned 4 [0285.744] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.744] lstrlenW (lpString=".xls") returned 4 [0285.744] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.744] lstrlenW (lpString=".xlsx") returned 5 [0285.745] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.745] lstrlenW (lpString=".ppt") returned 4 [0285.745] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.745] lstrlenW (lpString=".zip") returned 4 [0285.745] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.745] lstrlenW (lpString=".rar") returned 4 [0285.745] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.745] lstrlenW (lpString=".bz2") returned 4 [0285.745] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.745] lstrlenW (lpString=".7z") returned 3 [0285.745] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.745] lstrlenW (lpString=".dbf") returned 4 [0285.745] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.745] lstrlenW (lpString=".1cd") returned 4 [0285.745] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0285.745] lstrlenW (lpString=".jpg") returned 4 [0285.745] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.745] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0285.745] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0285.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.778] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=3584) returned 1 [0285.778] CloseHandle (hObject=0x204) returned 1 [0285.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0285.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.778] lstrlenW (lpString=".doc") returned 4 [0285.778] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.778] lstrlenW (lpString=".docx") returned 5 [0285.778] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.778] lstrlenW (lpString=".pdf") returned 4 [0285.778] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.778] lstrlenW (lpString=".xls") returned 4 [0285.778] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.778] lstrlenW (lpString=".xlsx") returned 5 [0285.778] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.778] lstrlenW (lpString=".ppt") returned 4 [0285.779] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.779] lstrlenW (lpString=".zip") returned 4 [0285.779] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.779] lstrlenW (lpString=".rar") returned 4 [0285.779] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.779] lstrlenW (lpString=".bz2") returned 4 [0285.779] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.779] lstrlenW (lpString=".7z") returned 3 [0285.779] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.779] lstrlenW (lpString=".dbf") returned 4 [0285.779] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.779] lstrlenW (lpString=".1cd") returned 4 [0285.779] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.779] lstrlenW (lpString=".jpg") returned 4 [0285.779] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.779] lstrlenW (lpString=".doc") returned 4 [0285.779] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.779] lstrlenW (lpString=".docx") returned 5 [0285.779] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.779] lstrlenW (lpString=".pdf") returned 4 [0285.779] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.779] lstrlenW (lpString=".xls") returned 4 [0285.779] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.779] lstrlenW (lpString=".xlsx") returned 5 [0285.780] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.780] lstrlenW (lpString=".ppt") returned 4 [0285.780] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.780] lstrlenW (lpString=".zip") returned 4 [0285.780] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.780] lstrlenW (lpString=".rar") returned 4 [0285.780] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.780] lstrlenW (lpString=".bz2") returned 4 [0285.780] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.780] lstrlenW (lpString=".7z") returned 3 [0285.780] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.780] lstrlenW (lpString=".dbf") returned 4 [0285.780] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.780] lstrlenW (lpString=".1cd") returned 4 [0285.780] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0285.780] lstrlenW (lpString=".jpg") returned 4 [0285.780] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.780] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0285.780] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0285.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.785] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=4096) returned 1 [0285.785] CloseHandle (hObject=0x204) returned 1 [0285.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0285.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.786] lstrlenW (lpString=".doc") returned 4 [0285.786] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.786] lstrlenW (lpString=".docx") returned 5 [0285.786] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.786] lstrlenW (lpString=".pdf") returned 4 [0285.786] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.786] lstrlenW (lpString=".xls") returned 4 [0285.786] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.786] lstrlenW (lpString=".xlsx") returned 5 [0285.786] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.786] lstrlenW (lpString=".ppt") returned 4 [0285.786] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.786] lstrlenW (lpString=".zip") returned 4 [0285.786] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.786] lstrlenW (lpString=".rar") returned 4 [0285.786] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.786] lstrlenW (lpString=".bz2") returned 4 [0285.786] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.786] lstrlenW (lpString=".7z") returned 3 [0285.786] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.786] lstrlenW (lpString=".dbf") returned 4 [0285.786] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.786] lstrlenW (lpString=".1cd") returned 4 [0285.787] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.787] lstrlenW (lpString=".jpg") returned 4 [0285.787] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.787] lstrlenW (lpString=".doc") returned 4 [0285.787] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.787] lstrlenW (lpString=".docx") returned 5 [0285.787] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.787] lstrlenW (lpString=".pdf") returned 4 [0285.787] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.787] lstrlenW (lpString=".xls") returned 4 [0285.787] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.787] lstrlenW (lpString=".xlsx") returned 5 [0285.787] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.787] lstrlenW (lpString=".ppt") returned 4 [0285.787] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.787] lstrlenW (lpString=".zip") returned 4 [0285.787] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.787] lstrlenW (lpString=".rar") returned 4 [0285.787] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.787] lstrlenW (lpString=".bz2") returned 4 [0285.787] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.787] lstrlenW (lpString=".7z") returned 3 [0285.787] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.787] lstrlenW (lpString=".dbf") returned 4 [0285.787] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.788] lstrlenW (lpString=".1cd") returned 4 [0285.788] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0285.788] lstrlenW (lpString=".jpg") returned 4 [0285.788] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.788] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0285.788] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0285.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.789] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=193024) returned 1 [0285.789] CloseHandle (hObject=0x204) returned 1 [0285.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0285.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.789] lstrlenW (lpString=".doc") returned 4 [0285.789] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0285.789] lstrlenW (lpString=".docx") returned 5 [0285.789] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0285.789] lstrlenW (lpString=".pdf") returned 4 [0285.789] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0285.789] lstrlenW (lpString=".xls") returned 4 [0285.790] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0285.790] lstrlenW (lpString=".xlsx") returned 5 [0285.790] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0285.790] lstrlenW (lpString=".ppt") returned 4 [0285.790] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0285.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.790] lstrlenW (lpString=".zip") returned 4 [0285.790] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0285.790] lstrlenW (lpString=".rar") returned 4 [0285.790] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0285.790] lstrlenW (lpString=".bz2") returned 4 [0285.790] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0285.790] lstrlenW (lpString=".7z") returned 3 [0285.790] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0285.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.790] lstrlenW (lpString=".dbf") returned 4 [0285.790] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0285.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.790] lstrlenW (lpString=".1cd") returned 4 [0285.790] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0285.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.790] lstrlenW (lpString=".jpg") returned 4 [0285.790] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0285.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.790] lstrlenW (lpString=".doc") returned 4 [0285.790] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0285.790] lstrlenW (lpString=".docx") returned 5 [0285.791] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0285.791] lstrlenW (lpString=".pdf") returned 4 [0285.791] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0285.791] lstrlenW (lpString=".xls") returned 4 [0285.791] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0285.791] lstrlenW (lpString=".xlsx") returned 5 [0285.791] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0285.791] lstrlenW (lpString=".ppt") returned 4 [0285.791] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.791] lstrlenW (lpString=".zip") returned 4 [0285.791] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0285.791] lstrlenW (lpString=".rar") returned 4 [0285.791] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0285.791] lstrlenW (lpString=".bz2") returned 4 [0285.791] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0285.791] lstrlenW (lpString=".7z") returned 3 [0285.791] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.791] lstrlenW (lpString=".dbf") returned 4 [0285.791] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.791] lstrlenW (lpString=".1cd") returned 4 [0285.791] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0285.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0285.791] lstrlenW (lpString=".jpg") returned 4 [0285.791] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0285.792] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0285.792] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0285.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.792] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=3584) returned 1 [0285.792] CloseHandle (hObject=0x204) returned 1 [0285.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0285.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.793] lstrlenW (lpString=".doc") returned 4 [0285.793] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.793] lstrlenW (lpString=".docx") returned 5 [0285.793] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.793] lstrlenW (lpString=".pdf") returned 4 [0285.793] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.793] lstrlenW (lpString=".xls") returned 4 [0285.793] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.793] lstrlenW (lpString=".xlsx") returned 5 [0285.793] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.793] lstrlenW (lpString=".ppt") returned 4 [0285.793] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.793] lstrlenW (lpString=".zip") returned 4 [0285.793] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.793] lstrlenW (lpString=".rar") returned 4 [0285.793] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.794] lstrlenW (lpString=".bz2") returned 4 [0285.794] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.794] lstrlenW (lpString=".7z") returned 3 [0285.794] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.794] lstrlenW (lpString=".dbf") returned 4 [0285.794] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.794] lstrlenW (lpString=".1cd") returned 4 [0285.794] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.794] lstrlenW (lpString=".jpg") returned 4 [0285.794] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.794] lstrlenW (lpString=".doc") returned 4 [0285.794] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.794] lstrlenW (lpString=".docx") returned 5 [0285.794] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.794] lstrlenW (lpString=".pdf") returned 4 [0285.794] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.794] lstrlenW (lpString=".xls") returned 4 [0285.794] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.794] lstrlenW (lpString=".xlsx") returned 5 [0285.794] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.794] lstrlenW (lpString=".ppt") returned 4 [0285.794] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.795] lstrlenW (lpString=".zip") returned 4 [0285.795] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.795] lstrlenW (lpString=".rar") returned 4 [0285.795] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.795] lstrlenW (lpString=".bz2") returned 4 [0285.795] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.795] lstrlenW (lpString=".7z") returned 3 [0285.795] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.795] lstrlenW (lpString=".dbf") returned 4 [0285.795] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.795] lstrlenW (lpString=".1cd") returned 4 [0285.795] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0285.795] lstrlenW (lpString=".jpg") returned 4 [0285.795] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.807] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0285.807] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0285.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0285.808] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=3584) returned 1 [0285.808] CloseHandle (hObject=0x164) returned 1 [0285.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0285.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.809] lstrlenW (lpString=".doc") returned 4 [0285.809] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.809] lstrlenW (lpString=".docx") returned 5 [0285.809] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.809] lstrlenW (lpString=".pdf") returned 4 [0285.809] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.809] lstrlenW (lpString=".xls") returned 4 [0285.809] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.809] lstrlenW (lpString=".xlsx") returned 5 [0285.809] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.809] lstrlenW (lpString=".ppt") returned 4 [0285.809] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.809] lstrlenW (lpString=".zip") returned 4 [0285.809] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.809] lstrlenW (lpString=".rar") returned 4 [0285.809] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.809] lstrlenW (lpString=".bz2") returned 4 [0285.809] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.809] lstrlenW (lpString=".7z") returned 3 [0285.809] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.809] lstrlenW (lpString=".dbf") returned 4 [0285.809] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.809] lstrlenW (lpString=".1cd") returned 4 [0285.810] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.810] lstrlenW (lpString=".jpg") returned 4 [0285.810] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.810] lstrlenW (lpString=".doc") returned 4 [0285.810] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.810] lstrlenW (lpString=".docx") returned 5 [0285.810] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.810] lstrlenW (lpString=".pdf") returned 4 [0285.810] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.810] lstrlenW (lpString=".xls") returned 4 [0285.810] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.810] lstrlenW (lpString=".xlsx") returned 5 [0285.810] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.810] lstrlenW (lpString=".ppt") returned 4 [0285.810] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.810] lstrlenW (lpString=".zip") returned 4 [0285.810] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.810] lstrlenW (lpString=".rar") returned 4 [0285.810] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.810] lstrlenW (lpString=".bz2") returned 4 [0285.810] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.810] lstrlenW (lpString=".7z") returned 3 [0285.810] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.811] lstrlenW (lpString=".dbf") returned 4 [0285.811] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0285.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.811] lstrlenW (lpString=".1cd") returned 4 [0285.811] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0285.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0285.812] lstrlenW (lpString=".jpg") returned 4 [0285.812] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0285.812] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0285.813] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0285.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0285.878] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=4096) returned 1 [0285.878] CloseHandle (hObject=0x1f4) returned 1 [0285.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0285.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0285.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0285.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0285.878] lstrlenW (lpString=".doc") returned 4 [0285.878] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0285.878] lstrlenW (lpString=".docx") returned 5 [0285.878] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0285.878] lstrlenW (lpString=".pdf") returned 4 [0285.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0285.878] lstrlenW (lpString=".xls") returned 4 [0285.878] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0285.878] lstrlenW (lpString=".xlsx") returned 5 [0285.878] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0285.878] lstrlenW (lpString=".ppt") returned 4 [0285.878] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0285.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0285.879] lstrlenW (lpString=".zip") returned 4 [0285.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0285.879] lstrlenW (lpString=".rar") returned 4 [0285.879] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0285.879] lstrlenW (lpString=".bz2") returned 4 [0285.879] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0285.879] lstrlenW (lpString=".7z") returned 3 [0285.879] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0285.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0285.879] lstrlenW (lpString=".dbf") returned 4 [0285.879] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0287.210] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.210] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0287.211] GetLastError () returned 0x0 [0287.211] ReadFile (in: hFile=0x1f4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0287.246] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0287.248] ReadFile (in: hFile=0x1f4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.249] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.249] SetEndOfFile (hFile=0x1b0) returned 1 [0287.249] CloseHandle (hObject=0x1b0) returned 1 [0287.249] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.249] SetEndOfFile (hFile=0x1f4) returned 1 [0287.250] CloseHandle (hObject=0x1f4) returned 1 [0287.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.251] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0287.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.251] lstrlenW (lpString=".doc") returned 4 [0287.251] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0287.251] lstrlenW (lpString=".docx") returned 5 [0287.251] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0287.251] lstrlenW (lpString=".pdf") returned 4 [0287.251] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0287.251] lstrlenW (lpString=".xls") returned 4 [0287.251] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0287.252] lstrlenW (lpString=".xlsx") returned 5 [0287.252] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0287.252] lstrlenW (lpString=".ppt") returned 4 [0287.252] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0287.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.252] lstrlenW (lpString=".zip") returned 4 [0287.252] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0287.252] lstrlenW (lpString=".rar") returned 4 [0287.252] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0287.252] lstrlenW (lpString=".bz2") returned 4 [0287.252] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0287.252] lstrlenW (lpString=".7z") returned 3 [0287.252] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0287.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.252] lstrlenW (lpString=".dbf") returned 4 [0287.252] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0287.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.252] lstrlenW (lpString=".1cd") returned 4 [0287.252] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0287.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.252] lstrlenW (lpString=".jpg") returned 4 [0287.253] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.253] lstrlenW (lpString=".doc") returned 4 [0287.253] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString=".docx") returned 5 [0287.253] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0287.253] lstrlenW (lpString=".pdf") returned 4 [0287.253] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString=".xls") returned 4 [0287.253] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString=".xlsx") returned 5 [0287.253] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0287.253] lstrlenW (lpString=".ppt") returned 4 [0287.253] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.253] lstrlenW (lpString=".zip") returned 4 [0287.253] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString=".rar") returned 4 [0287.253] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0287.253] lstrlenW (lpString=".bz2") returned 4 [0287.253] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0287.253] lstrlenW (lpString=".7z") returned 3 [0287.253] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0287.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.253] lstrlenW (lpString=".dbf") returned 4 [0287.253] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0287.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.254] lstrlenW (lpString=".1cd") returned 4 [0287.254] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0287.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0287.254] lstrlenW (lpString=".jpg") returned 4 [0287.254] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0287.254] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0287.254] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0287.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0287.255] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=154448) returned 1 [0287.255] CloseHandle (hObject=0x1f4) returned 1 [0287.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0287.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0287.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0287.255] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.255] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0287.256] GetLastError () returned 0x0 [0287.256] ReadFile (in: hFile=0x1f4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x25b50, lpOverlapped=0x0) returned 1 [0287.260] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0287.264] ReadFile (in: hFile=0x1f4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2b4fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.264] WriteFile (in: hFile=0x1b0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2b4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.264] SetEndOfFile (hFile=0x1b0) returned 1 [0287.264] CloseHandle (hObject=0x1b0) returned 1 [0287.264] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.264] SetEndOfFile (hFile=0x1f4) returned 1 [0287.266] CloseHandle (hObject=0x1f4) returned 1 [0287.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.267] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0287.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.267] lstrlenW (lpString=".doc") returned 4 [0287.267] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0287.267] lstrlenW (lpString=".docx") returned 5 [0287.267] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0287.267] lstrlenW (lpString=".pdf") returned 4 [0287.267] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0287.267] lstrlenW (lpString=".xls") returned 4 [0287.267] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0287.267] lstrlenW (lpString=".xlsx") returned 5 [0287.267] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0287.267] lstrlenW (lpString=".ppt") returned 4 [0287.267] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0287.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.267] lstrlenW (lpString=".zip") returned 4 [0287.267] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0287.267] lstrlenW (lpString=".rar") returned 4 [0287.267] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0287.267] lstrlenW (lpString=".bz2") returned 4 [0287.267] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0287.268] lstrlenW (lpString=".7z") returned 3 [0287.268] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0287.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.268] lstrlenW (lpString=".dbf") returned 4 [0287.268] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0287.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.268] lstrlenW (lpString=".1cd") returned 4 [0287.268] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0287.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.268] lstrlenW (lpString=".jpg") returned 4 [0287.268] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0287.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.268] lstrlenW (lpString=".doc") returned 4 [0287.268] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0287.268] lstrlenW (lpString=".docx") returned 5 [0287.268] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0287.268] lstrlenW (lpString=".pdf") returned 4 [0287.268] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0287.268] lstrlenW (lpString=".xls") returned 4 [0287.268] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0287.268] lstrlenW (lpString=".xlsx") returned 5 [0287.268] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0287.268] lstrlenW (lpString=".ppt") returned 4 [0287.268] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0287.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.268] lstrlenW (lpString=".zip") returned 4 [0287.269] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0287.269] lstrlenW (lpString=".rar") returned 4 [0287.269] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0287.269] lstrlenW (lpString=".bz2") returned 4 [0287.269] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0287.269] lstrlenW (lpString=".7z") returned 3 [0287.269] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0287.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.269] lstrlenW (lpString=".dbf") returned 4 [0287.269] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0287.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.269] lstrlenW (lpString=".1cd") returned 4 [0287.269] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0287.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0287.269] lstrlenW (lpString=".jpg") returned 4 [0287.269] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0287.269] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0287.269] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0287.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0287.270] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b4ff1c | out: lpFileSize=0x2b4ff1c*=2528128) returned 1 [0287.270] CloseHandle (hObject=0x1f4) returned 1 [0287.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0287.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0287.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[dr.web24@aol.com].drweb")) Thread: id = 11 os_tid = 0x8dc [0260.783] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3a0898 [0260.784] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3b08a0 [0260.784] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304b0 [0260.784] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x333210 [0260.784] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304c8 [0260.784] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3770020 [0260.784] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304e0 [0260.784] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3304e0, Size=0x20) returned 0x35fad8 [0260.785] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304e0 [0260.785] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3304e0, Size=0x20) returned 0x35fb00 [0260.785] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.785] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.785] Wow64DisableWow64FsRedirection (in: OldValue=0x2c8ff58 | out: OldValue=0x2c8ff58*=0x0) returned 1 [0260.785] lstrlenW (lpString="kernel32.dll") returned 12 [0260.785] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.785] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.785] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.785] Sleep (dwMilliseconds=0x64) [0261.293] lstrcmpiW (lpString1=".ini", lpString2=".drweb") returned 1 [0261.293] lstrlenW (lpString="desktop.ini") returned 11 [0261.293] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.340] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=129) returned 1 [0261.340] CloseHandle (hObject=0x16c) returned 1 [0261.340] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0261.340] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.340] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.340] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.340] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.340] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0261.341] GetLastError () returned 0x0 [0261.341] ReadFile (in: hFile=0x16c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x81, lpOverlapped=0x0) returned 1 [0261.355] WriteFile (in: hFile=0x170, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x90, lpOverlapped=0x0) returned 1 [0261.356] ReadFile (in: hFile=0x16c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.356] WriteFile (in: hFile=0x170, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0261.356] SetEndOfFile (hFile=0x170) returned 1 [0261.356] CloseHandle (hObject=0x170) returned 1 [0261.358] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.358] SetEndOfFile (hFile=0x16c) returned 1 [0261.359] CloseHandle (hObject=0x16c) returned 1 [0261.359] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x26) returned 1 [0261.360] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0261.360] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.360] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.360] lstrlenW (lpString=".doc") returned 4 [0261.360] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0261.360] lstrlenW (lpString=".docx") returned 5 [0261.360] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0261.360] lstrlenW (lpString=".pdf") returned 4 [0261.360] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0261.360] lstrlenW (lpString=".xls") returned 4 [0261.360] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0261.360] lstrlenW (lpString=".xlsx") returned 5 [0261.360] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0261.360] lstrlenW (lpString=".ppt") returned 4 [0261.360] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0261.361] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.361] lstrlenW (lpString=".zip") returned 4 [0261.361] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0261.361] lstrlenW (lpString=".rar") returned 4 [0261.361] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0261.361] lstrlenW (lpString=".bz2") returned 4 [0261.361] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0261.361] lstrlenW (lpString=".7z") returned 3 [0261.361] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0261.361] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.361] lstrlenW (lpString=".dbf") returned 4 [0261.361] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0261.361] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.361] lstrlenW (lpString=".1cd") returned 4 [0261.361] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0261.361] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.361] lstrlenW (lpString=".jpg") returned 4 [0261.361] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0261.361] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.361] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.361] lstrlenW (lpString=".doc") returned 4 [0261.361] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0261.361] lstrlenW (lpString=".docx") returned 5 [0261.361] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0261.361] lstrlenW (lpString=".pdf") returned 4 [0261.361] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0261.361] lstrlenW (lpString=".xls") returned 4 [0261.362] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0261.362] lstrlenW (lpString=".xlsx") returned 5 [0261.362] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0261.362] lstrlenW (lpString=".ppt") returned 4 [0261.362] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0261.362] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.362] lstrlenW (lpString=".zip") returned 4 [0261.362] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0261.362] lstrlenW (lpString=".rar") returned 4 [0261.362] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0261.362] lstrlenW (lpString=".bz2") returned 4 [0261.362] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0261.362] lstrlenW (lpString=".7z") returned 3 [0261.362] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0261.362] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.362] lstrlenW (lpString=".dbf") returned 4 [0261.362] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0261.362] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.362] lstrlenW (lpString=".1cd") returned 4 [0261.362] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0261.362] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0261.362] lstrlenW (lpString=".jpg") returned 4 [0261.362] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0261.363] lstrcmpiW (lpString1=".DAT", lpString2=".drweb") returned -1 [0261.363] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0261.363] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.363] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=65536) returned 1 [0261.363] CloseHandle (hObject=0x16c) returned 1 [0261.363] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0261.363] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.363] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.363] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.364] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.364] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0261.364] GetLastError () returned 0x0 [0261.364] ReadFile (in: hFile=0x16c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x10000, lpOverlapped=0x0) returned 1 [0261.392] WriteFile (in: hFile=0x170, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0261.394] ReadFile (in: hFile=0x16c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.394] WriteFile (in: hFile=0x170, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.394] SetEndOfFile (hFile=0x170) returned 1 [0261.394] CloseHandle (hObject=0x170) returned 1 [0261.397] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.600] SetEndOfFile (hFile=0x16c) returned 1 [0261.606] CloseHandle (hObject=0x16c) returned 1 [0261.606] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x26) returned 1 [0261.606] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0261.607] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.607] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.607] lstrlenW (lpString=".doc") returned 4 [0261.607] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0261.607] lstrlenW (lpString=".docx") returned 5 [0261.607] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0261.607] lstrlenW (lpString=".pdf") returned 4 [0261.607] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0261.607] lstrlenW (lpString=".xls") returned 4 [0261.607] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0261.607] lstrlenW (lpString=".xlsx") returned 5 [0261.607] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0261.607] lstrlenW (lpString=".ppt") returned 4 [0261.607] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0261.607] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.607] lstrlenW (lpString=".zip") returned 4 [0261.607] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0261.607] lstrlenW (lpString=".rar") returned 4 [0261.607] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0261.607] lstrlenW (lpString=".bz2") returned 4 [0261.607] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0261.607] lstrlenW (lpString=".7z") returned 3 [0261.607] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0261.608] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.608] lstrlenW (lpString=".dbf") returned 4 [0261.608] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.608] lstrlenW (lpString=".1cd") returned 4 [0261.608] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0261.608] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.608] lstrlenW (lpString=".jpg") returned 4 [0261.608] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.608] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.608] lstrlenW (lpString=".doc") returned 4 [0261.608] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString=".docx") returned 5 [0261.608] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0261.608] lstrlenW (lpString=".pdf") returned 4 [0261.608] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString=".xls") returned 4 [0261.608] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString=".xlsx") returned 5 [0261.608] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0261.608] lstrlenW (lpString=".ppt") returned 4 [0261.608] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.608] lstrlenW (lpString=".zip") returned 4 [0261.608] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0261.608] lstrlenW (lpString=".rar") returned 4 [0261.609] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0261.609] lstrlenW (lpString=".bz2") returned 4 [0261.609] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0261.609] lstrlenW (lpString=".7z") returned 3 [0261.609] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0261.609] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.609] lstrlenW (lpString=".dbf") returned 4 [0261.609] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0261.609] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.609] lstrlenW (lpString=".1cd") returned 4 [0261.609] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0261.609] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0261.609] lstrlenW (lpString=".jpg") returned 4 [0261.609] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0261.609] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.609] lstrlenW (lpString="Setup.xml") returned 9 [0261.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.778] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2296) returned 1 [0261.779] CloseHandle (hObject=0x174) returned 1 [0261.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0261.779] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.779] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.779] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.779] GetLastError () returned 0x0 [0261.779] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0261.793] WriteFile (in: hFile=0x16c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x900, lpOverlapped=0x0) returned 1 [0261.794] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.794] WriteFile (in: hFile=0x16c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0261.794] SetEndOfFile (hFile=0x16c) returned 1 [0261.795] CloseHandle (hObject=0x16c) returned 1 [0261.797] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.797] SetEndOfFile (hFile=0x174) returned 1 [0261.798] CloseHandle (hObject=0x174) returned 1 [0261.798] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0261.798] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0261.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.798] lstrlenW (lpString=".doc") returned 4 [0261.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString=".docx") returned 5 [0261.799] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0261.799] lstrlenW (lpString=".pdf") returned 4 [0261.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString=".xls") returned 4 [0261.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString=".xlsx") returned 5 [0261.799] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0261.799] lstrlenW (lpString=".ppt") returned 4 [0261.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.799] lstrlenW (lpString=".zip") returned 4 [0261.799] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.799] lstrlenW (lpString=".rar") returned 4 [0261.799] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString=".bz2") returned 4 [0261.799] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString=".7z") returned 3 [0261.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.799] lstrlenW (lpString=".dbf") returned 4 [0261.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.799] lstrlenW (lpString=".1cd") returned 4 [0261.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.800] lstrlenW (lpString=".jpg") returned 4 [0261.800] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.800] lstrlenW (lpString=".doc") returned 4 [0261.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString=".docx") returned 5 [0261.800] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0261.800] lstrlenW (lpString=".pdf") returned 4 [0261.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString=".xls") returned 4 [0261.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString=".xlsx") returned 5 [0261.800] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0261.800] lstrlenW (lpString=".ppt") returned 4 [0261.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.800] lstrlenW (lpString=".zip") returned 4 [0261.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.800] lstrlenW (lpString=".rar") returned 4 [0261.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString=".bz2") returned 4 [0261.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.800] lstrlenW (lpString=".7z") returned 3 [0261.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.801] lstrlenW (lpString=".dbf") returned 4 [0261.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.801] lstrlenW (lpString=".1cd") returned 4 [0261.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.801] lstrlenW (lpString=".jpg") returned 4 [0261.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.801] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.801] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0261.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.803] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1450) returned 1 [0261.803] CloseHandle (hObject=0x174) returned 1 [0261.803] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0261.804] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.804] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.804] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.804] GetLastError () returned 0x0 [0261.804] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0261.815] WriteFile (in: hFile=0x16c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0261.816] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.816] WriteFile (in: hFile=0x16c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0261.816] SetEndOfFile (hFile=0x16c) returned 1 [0261.816] CloseHandle (hObject=0x16c) returned 1 [0261.817] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.817] SetEndOfFile (hFile=0x174) returned 1 [0261.818] CloseHandle (hObject=0x174) returned 1 [0261.818] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0261.818] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0261.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.819] lstrlenW (lpString=".doc") returned 4 [0261.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.819] lstrlenW (lpString=".docx") returned 5 [0261.819] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0261.819] lstrlenW (lpString=".pdf") returned 4 [0261.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.819] lstrlenW (lpString=".xls") returned 4 [0261.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.819] lstrlenW (lpString=".xlsx") returned 5 [0261.819] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0261.819] lstrlenW (lpString=".ppt") returned 4 [0261.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.819] lstrlenW (lpString=".zip") returned 4 [0261.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.819] lstrlenW (lpString=".rar") returned 4 [0261.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.819] lstrlenW (lpString=".bz2") returned 4 [0261.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.819] lstrlenW (lpString=".7z") returned 3 [0261.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.820] lstrlenW (lpString=".dbf") returned 4 [0261.820] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.820] lstrlenW (lpString=".1cd") returned 4 [0261.820] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.820] lstrlenW (lpString=".jpg") returned 4 [0261.820] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.820] lstrlenW (lpString=".doc") returned 4 [0261.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.820] lstrlenW (lpString=".docx") returned 5 [0261.820] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0261.820] lstrlenW (lpString=".pdf") returned 4 [0261.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.820] lstrlenW (lpString=".xls") returned 4 [0261.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.820] lstrlenW (lpString=".xlsx") returned 5 [0261.820] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0261.821] lstrlenW (lpString=".ppt") returned 4 [0261.821] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.821] lstrlenW (lpString=".zip") returned 4 [0261.821] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.821] lstrlenW (lpString=".rar") returned 4 [0261.821] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.821] lstrlenW (lpString=".bz2") returned 4 [0261.821] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.821] lstrlenW (lpString=".7z") returned 3 [0261.821] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.821] lstrlenW (lpString=".dbf") returned 4 [0261.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.821] lstrlenW (lpString=".1cd") returned 4 [0261.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0261.821] lstrlenW (lpString=".jpg") returned 4 [0261.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.821] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.821] lstrlenW (lpString="Setup.xml") returned 9 [0261.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.822] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1608) returned 1 [0261.822] CloseHandle (hObject=0x174) returned 1 [0261.822] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0261.822] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.822] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.822] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.823] GetLastError () returned 0x0 [0261.823] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x648, lpOverlapped=0x0) returned 1 [0261.842] WriteFile (in: hFile=0x16c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x650, lpOverlapped=0x0) returned 1 [0261.843] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.843] WriteFile (in: hFile=0x16c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0261.843] SetEndOfFile (hFile=0x16c) returned 1 [0261.843] CloseHandle (hObject=0x16c) returned 1 [0261.844] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.844] SetEndOfFile (hFile=0x174) returned 1 [0261.845] CloseHandle (hObject=0x174) returned 1 [0261.845] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0261.845] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0261.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.845] lstrlenW (lpString=".doc") returned 4 [0261.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString=".docx") returned 5 [0261.846] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0261.846] lstrlenW (lpString=".pdf") returned 4 [0261.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString=".xls") returned 4 [0261.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString=".xlsx") returned 5 [0261.846] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0261.846] lstrlenW (lpString=".ppt") returned 4 [0261.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.846] lstrlenW (lpString=".zip") returned 4 [0261.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.846] lstrlenW (lpString=".rar") returned 4 [0261.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString=".bz2") returned 4 [0261.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString=".7z") returned 3 [0261.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.846] lstrlenW (lpString=".dbf") returned 4 [0261.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.846] lstrlenW (lpString=".1cd") returned 4 [0261.846] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.846] lstrlenW (lpString=".jpg") returned 4 [0261.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.847] lstrlenW (lpString=".doc") returned 4 [0261.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString=".docx") returned 5 [0261.847] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0261.847] lstrlenW (lpString=".pdf") returned 4 [0261.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString=".xls") returned 4 [0261.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString=".xlsx") returned 5 [0261.847] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0261.847] lstrlenW (lpString=".ppt") returned 4 [0261.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.847] lstrlenW (lpString=".zip") returned 4 [0261.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.847] lstrlenW (lpString=".rar") returned 4 [0261.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString=".bz2") returned 4 [0261.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.847] lstrlenW (lpString=".7z") returned 3 [0261.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.847] lstrlenW (lpString=".dbf") returned 4 [0261.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.848] lstrlenW (lpString=".1cd") returned 4 [0261.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.848] lstrlenW (lpString=".jpg") returned 4 [0261.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.848] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.848] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0261.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.849] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3186) returned 1 [0261.849] CloseHandle (hObject=0x174) returned 1 [0261.912] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0261.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.913] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.913] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0261.913] GetLastError () returned 0x0 [0261.913] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xc72, lpOverlapped=0x0) returned 1 [0261.929] WriteFile (in: hFile=0x188, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0261.930] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.930] WriteFile (in: hFile=0x188, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0261.931] SetEndOfFile (hFile=0x188) returned 1 [0261.931] CloseHandle (hObject=0x188) returned 1 [0261.932] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.932] SetEndOfFile (hFile=0x174) returned 1 [0261.933] CloseHandle (hObject=0x174) returned 1 [0261.933] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0261.933] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0261.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.933] lstrlenW (lpString=".doc") returned 4 [0261.933] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.933] lstrlenW (lpString=".docx") returned 5 [0261.933] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0261.934] lstrlenW (lpString=".pdf") returned 4 [0261.934] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.934] lstrlenW (lpString=".xls") returned 4 [0261.934] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.934] lstrlenW (lpString=".xlsx") returned 5 [0261.934] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0261.934] lstrlenW (lpString=".ppt") returned 4 [0261.934] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.934] lstrlenW (lpString=".zip") returned 4 [0261.934] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.934] lstrlenW (lpString=".rar") returned 4 [0261.934] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.934] lstrlenW (lpString=".bz2") returned 4 [0261.934] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.934] lstrlenW (lpString=".7z") returned 3 [0261.934] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.934] lstrlenW (lpString=".dbf") returned 4 [0261.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.935] lstrlenW (lpString=".1cd") returned 4 [0261.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.935] lstrlenW (lpString=".jpg") returned 4 [0261.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.935] lstrlenW (lpString=".doc") returned 4 [0261.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.935] lstrlenW (lpString=".docx") returned 5 [0261.935] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0261.936] lstrlenW (lpString=".pdf") returned 4 [0261.936] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString=".xls") returned 4 [0261.936] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString=".xlsx") returned 5 [0261.936] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0261.936] lstrlenW (lpString=".ppt") returned 4 [0261.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.936] lstrlenW (lpString=".zip") returned 4 [0261.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.936] lstrlenW (lpString=".rar") returned 4 [0261.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString=".bz2") returned 4 [0261.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString=".7z") returned 3 [0261.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.936] lstrlenW (lpString=".dbf") returned 4 [0261.936] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.936] lstrlenW (lpString=".1cd") returned 4 [0261.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0261.936] lstrlenW (lpString=".jpg") returned 4 [0261.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.937] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.937] lstrlenW (lpString="Setup.xml") returned 9 [0261.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.937] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4207) returned 1 [0261.937] CloseHandle (hObject=0x174) returned 1 [0261.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0261.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.937] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.937] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0261.938] GetLastError () returned 0x0 [0261.938] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x106f, lpOverlapped=0x0) returned 1 [0261.956] WriteFile (in: hFile=0x188, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0261.957] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.957] WriteFile (in: hFile=0x188, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0261.957] SetEndOfFile (hFile=0x188) returned 1 [0261.957] CloseHandle (hObject=0x188) returned 1 [0261.958] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.958] SetEndOfFile (hFile=0x174) returned 1 [0261.959] CloseHandle (hObject=0x174) returned 1 [0261.959] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0261.960] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0261.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.960] lstrlenW (lpString=".doc") returned 4 [0261.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.960] lstrlenW (lpString=".docx") returned 5 [0261.960] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0261.960] lstrlenW (lpString=".pdf") returned 4 [0261.960] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.960] lstrlenW (lpString=".xls") returned 4 [0261.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.960] lstrlenW (lpString=".xlsx") returned 5 [0261.961] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0261.961] lstrlenW (lpString=".ppt") returned 4 [0261.961] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.961] lstrlenW (lpString=".zip") returned 4 [0261.961] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.961] lstrlenW (lpString=".rar") returned 4 [0261.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.961] lstrlenW (lpString=".bz2") returned 4 [0261.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.961] lstrlenW (lpString=".7z") returned 3 [0261.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.961] lstrlenW (lpString=".dbf") returned 4 [0261.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.961] lstrlenW (lpString=".1cd") returned 4 [0261.961] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.961] lstrlenW (lpString=".jpg") returned 4 [0261.961] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.962] lstrlenW (lpString=".doc") returned 4 [0261.962] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString=".docx") returned 5 [0261.962] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0261.962] lstrlenW (lpString=".pdf") returned 4 [0261.962] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString=".xls") returned 4 [0261.962] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString=".xlsx") returned 5 [0261.962] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0261.962] lstrlenW (lpString=".ppt") returned 4 [0261.962] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.962] lstrlenW (lpString=".zip") returned 4 [0261.962] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.962] lstrlenW (lpString=".rar") returned 4 [0261.962] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString=".bz2") returned 4 [0261.962] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString=".7z") returned 3 [0261.962] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.962] lstrlenW (lpString=".dbf") returned 4 [0261.962] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.962] lstrlenW (lpString=".1cd") returned 4 [0261.962] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0261.963] lstrlenW (lpString=".jpg") returned 4 [0261.963] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.963] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.963] lstrlenW (lpString="Setup.xml") returned 9 [0261.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.964] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2424) returned 1 [0261.964] CloseHandle (hObject=0x174) returned 1 [0261.964] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0261.964] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.964] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.964] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.177] GetLastError () returned 0x0 [0262.177] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x978, lpOverlapped=0x0) returned 1 [0262.214] WriteFile (in: hFile=0x170, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x980, lpOverlapped=0x0) returned 1 [0262.215] ReadFile (in: hFile=0x174, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.215] WriteFile (in: hFile=0x170, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.215] SetEndOfFile (hFile=0x170) returned 1 [0262.215] CloseHandle (hObject=0x170) returned 1 [0262.224] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.224] SetEndOfFile (hFile=0x174) returned 1 [0262.225] CloseHandle (hObject=0x174) returned 1 [0262.225] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.225] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0262.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.226] lstrlenW (lpString=".doc") returned 4 [0262.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.226] lstrlenW (lpString=".docx") returned 5 [0262.226] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.226] lstrlenW (lpString=".pdf") returned 4 [0262.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.226] lstrlenW (lpString=".xls") returned 4 [0262.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.226] lstrlenW (lpString=".xlsx") returned 5 [0262.226] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.226] lstrlenW (lpString=".ppt") returned 4 [0262.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.226] lstrlenW (lpString=".zip") returned 4 [0262.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.227] lstrlenW (lpString=".rar") returned 4 [0262.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.227] lstrlenW (lpString=".bz2") returned 4 [0262.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.227] lstrlenW (lpString=".7z") returned 3 [0262.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.227] lstrlenW (lpString=".dbf") returned 4 [0262.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.227] lstrlenW (lpString=".1cd") returned 4 [0262.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.227] lstrlenW (lpString=".jpg") returned 4 [0262.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.227] lstrlenW (lpString=".doc") returned 4 [0262.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.228] lstrlenW (lpString=".docx") returned 5 [0262.228] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.228] lstrlenW (lpString=".pdf") returned 4 [0262.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.228] lstrlenW (lpString=".xls") returned 4 [0262.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.228] lstrlenW (lpString=".xlsx") returned 5 [0262.228] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.228] lstrlenW (lpString=".ppt") returned 4 [0262.228] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.228] lstrlenW (lpString=".zip") returned 4 [0262.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.228] lstrlenW (lpString=".rar") returned 4 [0262.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.228] lstrlenW (lpString=".bz2") returned 4 [0262.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.228] lstrlenW (lpString=".7z") returned 3 [0262.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.229] lstrlenW (lpString=".dbf") returned 4 [0262.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.229] lstrlenW (lpString=".1cd") returned 4 [0262.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.229] lstrlenW (lpString=".jpg") returned 4 [0262.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.229] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.229] lstrlenW (lpString="Proof.xml") returned 9 [0262.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.258] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1457) returned 1 [0262.258] CloseHandle (hObject=0x194) returned 1 [0262.258] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0262.258] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.258] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.258] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0262.259] GetLastError () returned 0x0 [0262.259] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0262.275] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0262.276] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.277] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.277] SetEndOfFile (hFile=0x1a0) returned 1 [0262.277] CloseHandle (hObject=0x1a0) returned 1 [0262.277] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.278] SetEndOfFile (hFile=0x194) returned 1 [0262.278] CloseHandle (hObject=0x194) returned 1 [0262.279] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.279] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0262.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.279] lstrlenW (lpString=".doc") returned 4 [0262.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.279] lstrlenW (lpString=".docx") returned 5 [0262.279] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0262.279] lstrlenW (lpString=".pdf") returned 4 [0262.279] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.279] lstrlenW (lpString=".xls") returned 4 [0262.279] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.279] lstrlenW (lpString=".xlsx") returned 5 [0262.279] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0262.279] lstrlenW (lpString=".ppt") returned 4 [0262.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.280] lstrlenW (lpString=".zip") returned 4 [0262.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.280] lstrlenW (lpString=".rar") returned 4 [0262.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString=".bz2") returned 4 [0262.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString=".7z") returned 3 [0262.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.280] lstrlenW (lpString=".dbf") returned 4 [0262.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.280] lstrlenW (lpString=".1cd") returned 4 [0262.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.280] lstrlenW (lpString=".jpg") returned 4 [0262.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.280] lstrlenW (lpString=".doc") returned 4 [0262.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.280] lstrlenW (lpString=".docx") returned 5 [0262.280] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0262.280] lstrlenW (lpString=".pdf") returned 4 [0262.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString=".xls") returned 4 [0262.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString=".xlsx") returned 5 [0262.281] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0262.281] lstrlenW (lpString=".ppt") returned 4 [0262.281] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.281] lstrlenW (lpString=".zip") returned 4 [0262.281] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.281] lstrlenW (lpString=".rar") returned 4 [0262.281] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString=".bz2") returned 4 [0262.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString=".7z") returned 3 [0262.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.281] lstrlenW (lpString=".dbf") returned 4 [0262.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.281] lstrlenW (lpString=".1cd") returned 4 [0262.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0262.281] lstrlenW (lpString=".jpg") returned 4 [0262.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.281] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.282] lstrlenW (lpString="Proof.xml") returned 9 [0262.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.282] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1458) returned 1 [0262.282] CloseHandle (hObject=0x194) returned 1 [0262.282] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0262.282] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.282] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.282] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0262.283] GetLastError () returned 0x0 [0262.283] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0262.303] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0262.304] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.304] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.304] SetEndOfFile (hFile=0x1a0) returned 1 [0262.304] CloseHandle (hObject=0x1a0) returned 1 [0262.305] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.305] SetEndOfFile (hFile=0x194) returned 1 [0262.306] CloseHandle (hObject=0x194) returned 1 [0262.306] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.306] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0262.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.307] lstrlenW (lpString=".doc") returned 4 [0262.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString=".docx") returned 5 [0262.307] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0262.307] lstrlenW (lpString=".pdf") returned 4 [0262.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString=".xls") returned 4 [0262.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString=".xlsx") returned 5 [0262.307] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0262.307] lstrlenW (lpString=".ppt") returned 4 [0262.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.307] lstrlenW (lpString=".zip") returned 4 [0262.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.307] lstrlenW (lpString=".rar") returned 4 [0262.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString=".bz2") returned 4 [0262.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString=".7z") returned 3 [0262.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.307] lstrlenW (lpString=".dbf") returned 4 [0262.307] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.308] lstrlenW (lpString=".1cd") returned 4 [0262.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.308] lstrlenW (lpString=".jpg") returned 4 [0262.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.308] lstrlenW (lpString=".doc") returned 4 [0262.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString=".docx") returned 5 [0262.308] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0262.308] lstrlenW (lpString=".pdf") returned 4 [0262.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString=".xls") returned 4 [0262.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString=".xlsx") returned 5 [0262.308] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0262.308] lstrlenW (lpString=".ppt") returned 4 [0262.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.308] lstrlenW (lpString=".zip") returned 4 [0262.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.308] lstrlenW (lpString=".rar") returned 4 [0262.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString=".bz2") returned 4 [0262.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.308] lstrlenW (lpString=".7z") returned 3 [0262.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.309] lstrlenW (lpString=".dbf") returned 4 [0262.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.309] lstrlenW (lpString=".1cd") returned 4 [0262.309] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0262.309] lstrlenW (lpString=".jpg") returned 4 [0262.309] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.309] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.309] lstrlenW (lpString="Office32MUI.xml") returned 15 [0262.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.310] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1383) returned 1 [0262.310] CloseHandle (hObject=0x194) returned 1 [0262.310] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0262.310] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.311] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.311] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0262.311] GetLastError () returned 0x0 [0262.311] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x567, lpOverlapped=0x0) returned 1 [0262.699] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0262.700] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.700] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0262.700] SetEndOfFile (hFile=0x1a0) returned 1 [0262.700] CloseHandle (hObject=0x1a0) returned 1 [0262.705] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.705] SetEndOfFile (hFile=0x194) returned 1 [0262.706] CloseHandle (hObject=0x194) returned 1 [0262.706] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.706] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0262.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.707] lstrlenW (lpString=".doc") returned 4 [0262.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.707] lstrlenW (lpString=".docx") returned 5 [0262.707] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.707] lstrlenW (lpString=".pdf") returned 4 [0262.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.707] lstrlenW (lpString=".xls") returned 4 [0262.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.707] lstrlenW (lpString=".xlsx") returned 5 [0262.707] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.707] lstrlenW (lpString=".ppt") returned 4 [0262.707] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.707] lstrlenW (lpString=".zip") returned 4 [0262.707] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.707] lstrlenW (lpString=".rar") returned 4 [0262.707] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.707] lstrlenW (lpString=".bz2") returned 4 [0262.707] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.707] lstrlenW (lpString=".7z") returned 3 [0262.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.708] lstrlenW (lpString=".dbf") returned 4 [0262.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.708] lstrlenW (lpString=".1cd") returned 4 [0262.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.708] lstrlenW (lpString=".jpg") returned 4 [0262.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.708] lstrlenW (lpString=".doc") returned 4 [0262.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString=".docx") returned 5 [0262.708] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.708] lstrlenW (lpString=".pdf") returned 4 [0262.708] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString=".xls") returned 4 [0262.708] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString=".xlsx") returned 5 [0262.708] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.708] lstrlenW (lpString=".ppt") returned 4 [0262.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.708] lstrlenW (lpString=".zip") returned 4 [0262.709] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.709] lstrlenW (lpString=".rar") returned 4 [0262.709] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.709] lstrlenW (lpString=".bz2") returned 4 [0262.709] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.709] lstrlenW (lpString=".7z") returned 3 [0262.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.709] lstrlenW (lpString=".dbf") returned 4 [0262.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.709] lstrlenW (lpString=".1cd") returned 4 [0262.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0262.709] lstrlenW (lpString=".jpg") returned 4 [0262.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.709] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.709] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0262.709] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.710] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1606) returned 1 [0262.710] CloseHandle (hObject=0x194) returned 1 [0262.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0262.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.711] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.711] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0262.711] GetLastError () returned 0x0 [0262.711] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x646, lpOverlapped=0x0) returned 1 [0262.736] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x650, lpOverlapped=0x0) returned 1 [0262.737] ReadFile (in: hFile=0x194, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.737] WriteFile (in: hFile=0x1a0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0262.737] SetEndOfFile (hFile=0x1a0) returned 1 [0262.737] CloseHandle (hObject=0x1a0) returned 1 [0262.738] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.738] SetEndOfFile (hFile=0x194) returned 1 [0262.739] CloseHandle (hObject=0x194) returned 1 [0262.739] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.739] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0263.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.087] lstrlenW (lpString=".doc") returned 4 [0263.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.087] lstrlenW (lpString=".docx") returned 5 [0263.087] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.087] lstrlenW (lpString=".pdf") returned 4 [0263.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.087] lstrlenW (lpString=".xls") returned 4 [0263.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.087] lstrlenW (lpString=".xlsx") returned 5 [0263.087] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.087] lstrlenW (lpString=".ppt") returned 4 [0263.087] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.088] lstrlenW (lpString=".zip") returned 4 [0263.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.088] lstrlenW (lpString=".rar") returned 4 [0263.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString=".bz2") returned 4 [0263.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString=".7z") returned 3 [0263.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.088] lstrlenW (lpString=".dbf") returned 4 [0263.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.088] lstrlenW (lpString=".1cd") returned 4 [0263.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.088] lstrlenW (lpString=".jpg") returned 4 [0263.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.088] lstrlenW (lpString=".doc") returned 4 [0263.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString=".docx") returned 5 [0263.088] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.088] lstrlenW (lpString=".pdf") returned 4 [0263.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.088] lstrlenW (lpString=".xls") returned 4 [0263.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.089] lstrlenW (lpString=".xlsx") returned 5 [0263.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.089] lstrlenW (lpString=".ppt") returned 4 [0263.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.089] lstrlenW (lpString=".zip") returned 4 [0263.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.089] lstrlenW (lpString=".rar") returned 4 [0263.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.089] lstrlenW (lpString=".bz2") returned 4 [0263.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.089] lstrlenW (lpString=".7z") returned 3 [0263.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.089] lstrlenW (lpString=".dbf") returned 4 [0263.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.089] lstrlenW (lpString=".1cd") returned 4 [0263.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0263.089] lstrlenW (lpString=".jpg") returned 4 [0263.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.090] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.090] lstrlenW (lpString="Setup.xml") returned 9 [0263.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.090] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1872) returned 1 [0263.090] CloseHandle (hObject=0x188) returned 1 [0263.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0263.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.090] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.091] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.091] GetLastError () returned 0x0 [0263.091] ReadFile (in: hFile=0x188, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x750, lpOverlapped=0x0) returned 1 [0263.101] WriteFile (in: hFile=0x1a4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0263.102] ReadFile (in: hFile=0x188, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.102] WriteFile (in: hFile=0x1a4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.102] SetEndOfFile (hFile=0x1a4) returned 1 [0263.102] CloseHandle (hObject=0x1a4) returned 1 [0263.103] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.103] SetEndOfFile (hFile=0x188) returned 1 [0263.103] CloseHandle (hObject=0x188) returned 1 [0263.103] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.104] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0263.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.104] lstrlenW (lpString=".doc") returned 4 [0263.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString=".docx") returned 5 [0263.104] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.104] lstrlenW (lpString=".pdf") returned 4 [0263.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString=".xls") returned 4 [0263.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString=".xlsx") returned 5 [0263.104] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.104] lstrlenW (lpString=".ppt") returned 4 [0263.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.104] lstrlenW (lpString=".zip") returned 4 [0263.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.104] lstrlenW (lpString=".rar") returned 4 [0263.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString=".bz2") returned 4 [0263.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString=".7z") returned 3 [0263.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.104] lstrlenW (lpString=".dbf") returned 4 [0263.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.104] lstrlenW (lpString=".1cd") returned 4 [0263.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.105] lstrlenW (lpString=".jpg") returned 4 [0263.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.105] lstrlenW (lpString=".doc") returned 4 [0263.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString=".docx") returned 5 [0263.105] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.105] lstrlenW (lpString=".pdf") returned 4 [0263.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString=".xls") returned 4 [0263.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString=".xlsx") returned 5 [0263.105] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.105] lstrlenW (lpString=".ppt") returned 4 [0263.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.105] lstrlenW (lpString=".zip") returned 4 [0263.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.105] lstrlenW (lpString=".rar") returned 4 [0263.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString=".bz2") returned 4 [0263.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString=".7z") returned 3 [0263.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.105] lstrlenW (lpString=".dbf") returned 4 [0263.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.105] lstrlenW (lpString=".1cd") returned 4 [0263.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.106] lstrlenW (lpString=".jpg") returned 4 [0263.106] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.106] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.106] lstrlenW (lpString="Setup.xml") returned 9 [0263.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.107] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1452) returned 1 [0263.107] CloseHandle (hObject=0x188) returned 1 [0263.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0263.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.107] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.107] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.108] GetLastError () returned 0x0 [0263.108] ReadFile (in: hFile=0x188, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0263.113] WriteFile (in: hFile=0x1a4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0263.114] ReadFile (in: hFile=0x188, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.114] WriteFile (in: hFile=0x1a4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.114] SetEndOfFile (hFile=0x1a4) returned 1 [0263.114] CloseHandle (hObject=0x1a4) returned 1 [0263.115] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.115] SetEndOfFile (hFile=0x188) returned 1 [0263.115] CloseHandle (hObject=0x188) returned 1 [0263.116] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.116] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0263.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.116] lstrlenW (lpString=".doc") returned 4 [0263.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.116] lstrlenW (lpString=".docx") returned 5 [0263.116] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.116] lstrlenW (lpString=".pdf") returned 4 [0263.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.116] lstrlenW (lpString=".xls") returned 4 [0263.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.116] lstrlenW (lpString=".xlsx") returned 5 [0263.116] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.116] lstrlenW (lpString=".ppt") returned 4 [0263.116] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.116] lstrlenW (lpString=".zip") returned 4 [0263.116] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.116] lstrlenW (lpString=".rar") returned 4 [0263.116] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.116] lstrlenW (lpString=".bz2") returned 4 [0263.116] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.116] lstrlenW (lpString=".7z") returned 3 [0263.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.117] lstrlenW (lpString=".dbf") returned 4 [0263.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.117] lstrlenW (lpString=".1cd") returned 4 [0263.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.117] lstrlenW (lpString=".jpg") returned 4 [0263.117] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.117] lstrlenW (lpString=".doc") returned 4 [0263.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString=".docx") returned 5 [0263.117] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.117] lstrlenW (lpString=".pdf") returned 4 [0263.117] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString=".xls") returned 4 [0263.117] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString=".xlsx") returned 5 [0263.117] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.117] lstrlenW (lpString=".ppt") returned 4 [0263.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.117] lstrlenW (lpString=".zip") returned 4 [0263.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.118] lstrlenW (lpString=".rar") returned 4 [0263.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.118] lstrlenW (lpString=".bz2") returned 4 [0263.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.118] lstrlenW (lpString=".7z") returned 3 [0263.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.118] lstrlenW (lpString=".dbf") returned 4 [0263.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.118] lstrlenW (lpString=".1cd") returned 4 [0263.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.118] lstrlenW (lpString=".jpg") returned 4 [0263.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.118] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.118] lstrlenW (lpString="branding.xml") returned 12 [0263.118] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.119] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=596341) returned 1 [0263.119] CloseHandle (hObject=0x188) returned 1 [0263.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0263.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.119] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0263.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.119] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.120] GetLastError () returned 0x0 [0263.120] ReadFile (in: hFile=0x188, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0263.147] WriteFile (in: hFile=0x1a4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0263.158] ReadFile (in: hFile=0x188, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.158] WriteFile (in: hFile=0x1a4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.158] SetEndOfFile (hFile=0x1a4) returned 1 [0263.158] CloseHandle (hObject=0x1a4) returned 1 [0263.406] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.406] SetEndOfFile (hFile=0x188) returned 1 [0263.411] CloseHandle (hObject=0x188) returned 1 [0263.411] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.411] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0263.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.427] lstrlenW (lpString=".doc") returned 4 [0263.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString=".docx") returned 5 [0263.427] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0263.427] lstrlenW (lpString=".pdf") returned 4 [0263.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString=".xls") returned 4 [0263.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString=".xlsx") returned 5 [0263.427] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0263.427] lstrlenW (lpString=".ppt") returned 4 [0263.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.427] lstrlenW (lpString=".zip") returned 4 [0263.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.427] lstrlenW (lpString=".rar") returned 4 [0263.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString=".bz2") returned 4 [0263.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString=".7z") returned 3 [0263.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.427] lstrlenW (lpString=".dbf") returned 4 [0263.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.427] lstrlenW (lpString=".1cd") returned 4 [0263.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.427] lstrlenW (lpString=".jpg") returned 4 [0263.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.428] lstrlenW (lpString=".doc") returned 4 [0263.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString=".docx") returned 5 [0263.428] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0263.428] lstrlenW (lpString=".pdf") returned 4 [0263.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString=".xls") returned 4 [0263.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString=".xlsx") returned 5 [0263.428] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0263.428] lstrlenW (lpString=".ppt") returned 4 [0263.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.428] lstrlenW (lpString=".zip") returned 4 [0263.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.428] lstrlenW (lpString=".rar") returned 4 [0263.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString=".bz2") returned 4 [0263.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString=".7z") returned 3 [0263.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.428] lstrlenW (lpString=".dbf") returned 4 [0263.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.428] lstrlenW (lpString=".1cd") returned 4 [0263.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0263.428] lstrlenW (lpString=".jpg") returned 4 [0263.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.429] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.429] lstrlenW (lpString="Setup.xml") returned 9 [0263.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.429] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9352) returned 1 [0263.429] CloseHandle (hObject=0x1a4) returned 1 [0263.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0263.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.429] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.429] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0263.430] GetLastError () returned 0x0 [0263.430] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x2488, lpOverlapped=0x0) returned 1 [0263.679] WriteFile (in: hFile=0x19c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0263.680] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.680] WriteFile (in: hFile=0x19c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.680] SetEndOfFile (hFile=0x19c) returned 1 [0263.681] CloseHandle (hObject=0x19c) returned 1 [0263.681] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.681] SetEndOfFile (hFile=0x1a4) returned 1 [0263.682] CloseHandle (hObject=0x1a4) returned 1 [0263.682] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.683] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0263.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.683] lstrlenW (lpString=".doc") returned 4 [0263.683] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.683] lstrlenW (lpString=".docx") returned 5 [0263.683] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.683] lstrlenW (lpString=".pdf") returned 4 [0263.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.683] lstrlenW (lpString=".xls") returned 4 [0263.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.683] lstrlenW (lpString=".xlsx") returned 5 [0263.683] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.683] lstrlenW (lpString=".ppt") returned 4 [0263.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.683] lstrlenW (lpString=".zip") returned 4 [0263.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.683] lstrlenW (lpString=".rar") returned 4 [0263.683] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.683] lstrlenW (lpString=".bz2") returned 4 [0263.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString=".7z") returned 3 [0263.684] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.684] lstrlenW (lpString=".dbf") returned 4 [0263.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.684] lstrlenW (lpString=".1cd") returned 4 [0263.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.684] lstrlenW (lpString=".jpg") returned 4 [0263.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.684] lstrlenW (lpString=".doc") returned 4 [0263.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString=".docx") returned 5 [0263.684] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.684] lstrlenW (lpString=".pdf") returned 4 [0263.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString=".xls") returned 4 [0263.684] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.684] lstrlenW (lpString=".xlsx") returned 5 [0263.684] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.684] lstrlenW (lpString=".ppt") returned 4 [0263.684] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.685] lstrlenW (lpString=".zip") returned 4 [0263.685] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.685] lstrlenW (lpString=".rar") returned 4 [0263.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.685] lstrlenW (lpString=".bz2") returned 4 [0263.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.685] lstrlenW (lpString=".7z") returned 3 [0263.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.685] lstrlenW (lpString=".dbf") returned 4 [0263.685] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.685] lstrlenW (lpString=".1cd") returned 4 [0263.685] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.685] lstrlenW (lpString=".jpg") returned 4 [0263.685] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.685] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.685] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0263.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.686] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=819) returned 1 [0263.686] CloseHandle (hObject=0x1a4) returned 1 [0263.686] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0263.686] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0263.686] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.686] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.687] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0263.687] GetLastError () returned 0x0 [0263.687] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x333, lpOverlapped=0x0) returned 1 [0263.961] WriteFile (in: hFile=0x19c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x340, lpOverlapped=0x0) returned 1 [0263.962] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.962] WriteFile (in: hFile=0x19c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0263.962] SetEndOfFile (hFile=0x19c) returned 1 [0263.962] CloseHandle (hObject=0x19c) returned 1 [0263.963] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.963] SetEndOfFile (hFile=0x1a4) returned 1 [0263.963] CloseHandle (hObject=0x1a4) returned 1 [0263.963] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.964] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0263.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.964] lstrlenW (lpString=".doc") returned 4 [0263.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString=".docx") returned 5 [0263.964] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0263.964] lstrlenW (lpString=".pdf") returned 4 [0263.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString=".xls") returned 4 [0263.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString=".xlsx") returned 5 [0263.964] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0263.964] lstrlenW (lpString=".ppt") returned 4 [0263.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.964] lstrlenW (lpString=".zip") returned 4 [0263.964] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.964] lstrlenW (lpString=".rar") returned 4 [0263.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString=".bz2") returned 4 [0263.964] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString=".7z") returned 3 [0263.964] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.964] lstrlenW (lpString=".dbf") returned 4 [0263.964] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.964] lstrlenW (lpString=".1cd") returned 4 [0263.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString=".jpg") returned 4 [0263.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString=".doc") returned 4 [0263.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString=".docx") returned 5 [0263.965] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0263.965] lstrlenW (lpString=".pdf") returned 4 [0263.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString=".xls") returned 4 [0263.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString=".xlsx") returned 5 [0263.965] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0263.965] lstrlenW (lpString=".ppt") returned 4 [0263.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString=".zip") returned 4 [0263.965] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.965] lstrlenW (lpString=".rar") returned 4 [0263.965] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString=".bz2") returned 4 [0263.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString=".7z") returned 3 [0263.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString=".dbf") returned 4 [0263.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString=".1cd") returned 4 [0263.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0263.965] lstrlenW (lpString=".jpg") returned 4 [0263.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.966] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.966] lstrlenW (lpString="Setup.xml") returned 9 [0263.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.020] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=31094) returned 1 [0264.020] CloseHandle (hObject=0x1c0) returned 1 [0264.021] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0264.021] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.021] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.021] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0264.021] GetLastError () returned 0x0 [0264.021] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0264.159] WriteFile (in: hFile=0x1c4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0264.160] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.160] WriteFile (in: hFile=0x1c4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.161] SetEndOfFile (hFile=0x1c4) returned 1 [0264.161] CloseHandle (hObject=0x1c4) returned 1 [0264.162] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.162] SetEndOfFile (hFile=0x1c0) returned 1 [0264.163] CloseHandle (hObject=0x1c0) returned 1 [0264.163] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.163] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0264.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.164] lstrlenW (lpString=".doc") returned 4 [0264.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString=".docx") returned 5 [0264.164] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0264.164] lstrlenW (lpString=".pdf") returned 4 [0264.164] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString=".xls") returned 4 [0264.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString=".xlsx") returned 5 [0264.164] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0264.164] lstrlenW (lpString=".ppt") returned 4 [0264.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.164] lstrlenW (lpString=".zip") returned 4 [0264.164] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.164] lstrlenW (lpString=".rar") returned 4 [0264.164] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString=".bz2") returned 4 [0264.164] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString=".7z") returned 3 [0264.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.164] lstrlenW (lpString=".dbf") returned 4 [0264.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.165] lstrlenW (lpString=".1cd") returned 4 [0264.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.165] lstrlenW (lpString=".jpg") returned 4 [0264.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.165] lstrlenW (lpString=".doc") returned 4 [0264.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString=".docx") returned 5 [0264.165] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0264.165] lstrlenW (lpString=".pdf") returned 4 [0264.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString=".xls") returned 4 [0264.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString=".xlsx") returned 5 [0264.165] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0264.165] lstrlenW (lpString=".ppt") returned 4 [0264.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.165] lstrlenW (lpString=".zip") returned 4 [0264.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.165] lstrlenW (lpString=".rar") returned 4 [0264.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString=".bz2") returned 4 [0264.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.165] lstrlenW (lpString=".7z") returned 3 [0264.165] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.166] lstrlenW (lpString=".dbf") returned 4 [0264.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.166] lstrlenW (lpString=".1cd") returned 4 [0264.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.166] lstrlenW (lpString=".jpg") returned 4 [0264.166] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.166] lstrcmpiW (lpString1=".EPS", lpString2=".drweb") returned 1 [0264.166] lstrlenW (lpString="MS.EPS") returned 6 [0264.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0264.210] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=15067) returned 1 [0264.210] CloseHandle (hObject=0x190) returned 1 [0264.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0264.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0264.210] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.210] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0264.211] GetLastError () returned 0x0 [0264.211] ReadFile (in: hFile=0x190, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0264.223] WriteFile (in: hFile=0x1ac, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0264.224] ReadFile (in: hFile=0x190, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.225] WriteFile (in: hFile=0x1ac, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0264.225] SetEndOfFile (hFile=0x1ac) returned 1 [0264.225] CloseHandle (hObject=0x1ac) returned 1 [0264.226] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.226] SetEndOfFile (hFile=0x190) returned 1 [0264.227] CloseHandle (hObject=0x190) returned 1 [0264.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0264.227] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0264.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.227] lstrlenW (lpString=".doc") returned 4 [0264.227] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0264.227] lstrlenW (lpString=".docx") returned 5 [0264.227] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0264.228] lstrlenW (lpString=".pdf") returned 4 [0264.228] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0264.228] lstrlenW (lpString=".xls") returned 4 [0264.228] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0264.228] lstrlenW (lpString=".xlsx") returned 5 [0264.228] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0264.228] lstrlenW (lpString=".ppt") returned 4 [0264.228] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0264.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.228] lstrlenW (lpString=".zip") returned 4 [0264.228] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0264.228] lstrlenW (lpString=".rar") returned 4 [0264.228] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0264.228] lstrlenW (lpString=".bz2") returned 4 [0264.228] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0264.228] lstrlenW (lpString=".7z") returned 3 [0264.228] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0264.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.228] lstrlenW (lpString=".dbf") returned 4 [0264.228] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0264.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.228] lstrlenW (lpString=".1cd") returned 4 [0264.228] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0264.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.228] lstrlenW (lpString=".jpg") returned 4 [0264.228] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0264.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.229] lstrlenW (lpString=".doc") returned 4 [0264.229] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0264.229] lstrlenW (lpString=".docx") returned 5 [0264.229] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0264.229] lstrlenW (lpString=".pdf") returned 4 [0264.229] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0264.229] lstrlenW (lpString=".xls") returned 4 [0264.229] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0264.229] lstrlenW (lpString=".xlsx") returned 5 [0264.229] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0264.229] lstrlenW (lpString=".ppt") returned 4 [0264.229] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0264.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.229] lstrlenW (lpString=".zip") returned 4 [0264.229] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0264.229] lstrlenW (lpString=".rar") returned 4 [0264.229] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0264.229] lstrlenW (lpString=".bz2") returned 4 [0264.229] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0264.229] lstrlenW (lpString=".7z") returned 3 [0264.229] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0264.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.229] lstrlenW (lpString=".dbf") returned 4 [0264.229] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0264.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.229] lstrlenW (lpString=".1cd") returned 4 [0264.229] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0264.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0264.230] lstrlenW (lpString=".jpg") returned 4 [0264.230] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0264.230] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.230] lstrlenW (lpString="Content.xml") returned 11 [0264.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.258] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=27045) returned 1 [0264.258] CloseHandle (hObject=0x1c0) returned 1 [0264.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0264.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.259] lstrlenW (lpString=".doc") returned 4 [0264.259] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.259] lstrlenW (lpString=".docx") returned 5 [0264.259] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0264.259] lstrlenW (lpString=".pdf") returned 4 [0264.259] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.259] lstrlenW (lpString=".xls") returned 4 [0264.259] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.259] lstrlenW (lpString=".xlsx") returned 5 [0264.259] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0264.259] lstrlenW (lpString=".ppt") returned 4 [0264.259] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.259] lstrlenW (lpString=".zip") returned 4 [0264.259] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.259] lstrlenW (lpString=".rar") returned 4 [0264.259] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.259] lstrlenW (lpString=".bz2") returned 4 [0264.260] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString=".7z") returned 3 [0264.260] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.260] lstrlenW (lpString=".dbf") returned 4 [0264.260] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.260] lstrlenW (lpString=".1cd") returned 4 [0264.260] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.260] lstrlenW (lpString=".jpg") returned 4 [0264.260] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.260] lstrlenW (lpString=".doc") returned 4 [0264.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString=".docx") returned 5 [0264.260] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0264.260] lstrlenW (lpString=".pdf") returned 4 [0264.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString=".xls") returned 4 [0264.260] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.260] lstrlenW (lpString=".xlsx") returned 5 [0264.260] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0264.260] lstrlenW (lpString=".ppt") returned 4 [0264.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.261] lstrlenW (lpString=".zip") returned 4 [0264.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.261] lstrlenW (lpString=".rar") returned 4 [0264.261] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.261] lstrlenW (lpString=".bz2") returned 4 [0264.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.261] lstrlenW (lpString=".7z") returned 3 [0264.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.261] lstrlenW (lpString=".dbf") returned 4 [0264.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.261] lstrlenW (lpString=".1cd") returned 4 [0264.261] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0264.261] lstrlenW (lpString=".jpg") returned 4 [0264.261] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.261] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.261] lstrlenW (lpString="boxed-split.avi") returned 15 [0264.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.280] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=62976) returned 1 [0264.280] CloseHandle (hObject=0x1c0) returned 1 [0264.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0264.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.280] lstrlenW (lpString=".doc") returned 4 [0264.280] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.280] lstrlenW (lpString=".docx") returned 5 [0264.281] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.281] lstrlenW (lpString=".pdf") returned 4 [0264.281] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString=".xls") returned 4 [0264.281] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString=".xlsx") returned 5 [0264.281] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.281] lstrlenW (lpString=".ppt") returned 4 [0264.281] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.281] lstrlenW (lpString=".zip") returned 4 [0264.281] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString=".rar") returned 4 [0264.281] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString=".bz2") returned 4 [0264.281] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString=".7z") returned 3 [0264.281] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.281] lstrlenW (lpString=".dbf") returned 4 [0264.281] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.281] lstrlenW (lpString=".1cd") returned 4 [0264.281] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.281] lstrlenW (lpString=".jpg") returned 4 [0264.281] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.281] lstrlenW (lpString=".doc") returned 4 [0264.282] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString=".docx") returned 5 [0264.282] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.282] lstrlenW (lpString=".pdf") returned 4 [0264.282] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString=".xls") returned 4 [0264.282] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString=".xlsx") returned 5 [0264.282] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.282] lstrlenW (lpString=".ppt") returned 4 [0264.282] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.282] lstrlenW (lpString=".zip") returned 4 [0264.282] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString=".rar") returned 4 [0264.282] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString=".bz2") returned 4 [0264.282] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString=".7z") returned 3 [0264.282] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.282] lstrlenW (lpString=".dbf") returned 4 [0264.282] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.282] lstrlenW (lpString=".1cd") returned 4 [0264.282] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0264.282] lstrlenW (lpString=".jpg") returned 4 [0264.283] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.283] Sleep (dwMilliseconds=0x64) [0264.742] Sleep (dwMilliseconds=0x64) [0265.025] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.025] lstrlenW (lpString="auxpad.xml") returned 10 [0265.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.128] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=212) returned 1 [0265.128] CloseHandle (hObject=0x1c4) returned 1 [0265.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0265.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.128] lstrlenW (lpString=".doc") returned 4 [0265.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.128] lstrlenW (lpString=".docx") returned 5 [0265.128] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0265.128] lstrlenW (lpString=".pdf") returned 4 [0265.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.128] lstrlenW (lpString=".xls") returned 4 [0265.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.128] lstrlenW (lpString=".xlsx") returned 5 [0265.128] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0265.128] lstrlenW (lpString=".ppt") returned 4 [0265.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.128] lstrlenW (lpString=".zip") returned 4 [0265.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.129] lstrlenW (lpString=".rar") returned 4 [0265.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString=".bz2") returned 4 [0265.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString=".7z") returned 3 [0265.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.129] lstrlenW (lpString=".dbf") returned 4 [0265.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.129] lstrlenW (lpString=".1cd") returned 4 [0265.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.129] lstrlenW (lpString=".jpg") returned 4 [0265.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.129] lstrlenW (lpString=".doc") returned 4 [0265.129] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString=".docx") returned 5 [0265.129] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0265.129] lstrlenW (lpString=".pdf") returned 4 [0265.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString=".xls") returned 4 [0265.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.129] lstrlenW (lpString=".xlsx") returned 5 [0265.129] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0265.129] lstrlenW (lpString=".ppt") returned 4 [0265.130] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.130] lstrlenW (lpString=".zip") returned 4 [0265.130] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.130] lstrlenW (lpString=".rar") returned 4 [0265.130] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.130] lstrlenW (lpString=".bz2") returned 4 [0265.130] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.130] lstrlenW (lpString=".7z") returned 3 [0265.130] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.130] lstrlenW (lpString=".dbf") returned 4 [0265.130] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.130] lstrlenW (lpString=".1cd") returned 4 [0265.130] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0265.131] lstrlenW (lpString=".jpg") returned 4 [0265.131] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.131] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.131] lstrlenW (lpString="kor-kor.xml") returned 11 [0265.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.141] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=392) returned 1 [0265.142] CloseHandle (hObject=0x1c4) returned 1 [0265.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0265.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.142] lstrlenW (lpString=".doc") returned 4 [0265.142] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.142] lstrlenW (lpString=".docx") returned 5 [0265.142] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0265.142] lstrlenW (lpString=".pdf") returned 4 [0265.142] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.142] lstrlenW (lpString=".xls") returned 4 [0265.142] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.142] lstrlenW (lpString=".xlsx") returned 5 [0265.142] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0265.142] lstrlenW (lpString=".ppt") returned 4 [0265.142] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.142] lstrlenW (lpString=".zip") returned 4 [0265.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.143] lstrlenW (lpString=".rar") returned 4 [0265.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString=".bz2") returned 4 [0265.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString=".7z") returned 3 [0265.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.143] lstrlenW (lpString=".dbf") returned 4 [0265.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.143] lstrlenW (lpString=".1cd") returned 4 [0265.143] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.143] lstrlenW (lpString=".jpg") returned 4 [0265.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.143] lstrlenW (lpString=".doc") returned 4 [0265.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString=".docx") returned 5 [0265.143] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0265.143] lstrlenW (lpString=".pdf") returned 4 [0265.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString=".xls") returned 4 [0265.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.143] lstrlenW (lpString=".xlsx") returned 5 [0265.143] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0265.144] lstrlenW (lpString=".ppt") returned 4 [0265.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.144] lstrlenW (lpString=".zip") returned 4 [0265.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.144] lstrlenW (lpString=".rar") returned 4 [0265.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.144] lstrlenW (lpString=".bz2") returned 4 [0265.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.144] lstrlenW (lpString=".7z") returned 3 [0265.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.144] lstrlenW (lpString=".dbf") returned 4 [0265.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.144] lstrlenW (lpString=".1cd") returned 4 [0265.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0265.144] lstrlenW (lpString=".jpg") returned 4 [0265.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.144] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.144] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0265.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.191] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=247) returned 1 [0265.191] CloseHandle (hObject=0x1c4) returned 1 [0265.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0265.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.192] lstrlenW (lpString=".doc") returned 4 [0265.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.192] lstrlenW (lpString=".docx") returned 5 [0265.192] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0265.192] lstrlenW (lpString=".pdf") returned 4 [0265.192] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.192] lstrlenW (lpString=".xls") returned 4 [0265.192] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.192] lstrlenW (lpString=".xlsx") returned 5 [0265.192] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0265.192] lstrlenW (lpString=".ppt") returned 4 [0265.192] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.192] lstrlenW (lpString=".zip") returned 4 [0265.192] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.192] lstrlenW (lpString=".rar") returned 4 [0265.192] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString=".bz2") returned 4 [0265.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString=".7z") returned 3 [0265.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.193] lstrlenW (lpString=".dbf") returned 4 [0265.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.193] lstrlenW (lpString=".1cd") returned 4 [0265.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.193] lstrlenW (lpString=".jpg") returned 4 [0265.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.193] lstrlenW (lpString=".doc") returned 4 [0265.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString=".docx") returned 5 [0265.193] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0265.193] lstrlenW (lpString=".pdf") returned 4 [0265.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString=".xls") returned 4 [0265.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString=".xlsx") returned 5 [0265.193] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0265.193] lstrlenW (lpString=".ppt") returned 4 [0265.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.194] lstrlenW (lpString=".zip") returned 4 [0265.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.194] lstrlenW (lpString=".rar") returned 4 [0265.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.194] lstrlenW (lpString=".bz2") returned 4 [0265.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.194] lstrlenW (lpString=".7z") returned 3 [0265.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.194] lstrlenW (lpString=".dbf") returned 4 [0265.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.194] lstrlenW (lpString=".1cd") returned 4 [0265.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0265.194] lstrlenW (lpString=".jpg") returned 4 [0265.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.194] lstrcmpiW (lpString1=".dat", lpString2=".drweb") returned -1 [0265.194] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0265.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.423] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1100368) returned 1 [0265.423] CloseHandle (hObject=0x1b0) returned 1 [0265.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0265.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.423] lstrlenW (lpString=".doc") returned 4 [0265.423] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.423] lstrlenW (lpString=".docx") returned 5 [0265.423] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0265.423] lstrlenW (lpString=".pdf") returned 4 [0265.423] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.423] lstrlenW (lpString=".xls") returned 4 [0265.423] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.423] lstrlenW (lpString=".xlsx") returned 5 [0265.423] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0265.423] lstrlenW (lpString=".ppt") returned 4 [0265.423] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.424] lstrlenW (lpString=".zip") returned 4 [0265.424] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString=".rar") returned 4 [0265.424] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString=".bz2") returned 4 [0265.424] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.424] lstrlenW (lpString=".7z") returned 3 [0265.424] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.424] lstrlenW (lpString=".dbf") returned 4 [0265.424] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.424] lstrlenW (lpString=".1cd") returned 4 [0265.424] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.424] lstrlenW (lpString=".jpg") returned 4 [0265.424] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.424] lstrlenW (lpString=".doc") returned 4 [0265.424] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString=".docx") returned 5 [0265.424] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0265.424] lstrlenW (lpString=".pdf") returned 4 [0265.424] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.424] lstrlenW (lpString=".xls") returned 4 [0265.425] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.425] lstrlenW (lpString=".xlsx") returned 5 [0265.425] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0265.425] lstrlenW (lpString=".ppt") returned 4 [0265.425] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.425] lstrlenW (lpString=".zip") returned 4 [0265.425] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.425] lstrlenW (lpString=".rar") returned 4 [0265.425] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.425] lstrlenW (lpString=".bz2") returned 4 [0265.425] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.425] lstrlenW (lpString=".7z") returned 3 [0265.425] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.425] lstrlenW (lpString=".dbf") returned 4 [0265.425] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.425] lstrlenW (lpString=".1cd") returned 4 [0265.425] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0265.425] lstrlenW (lpString=".jpg") returned 4 [0265.425] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.426] lstrcmpiW (lpString1=".dat", lpString2=".drweb") returned -1 [0265.426] lstrlenW (lpString="hwruksh.dat") returned 11 [0265.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.426] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2227968) returned 1 [0265.426] CloseHandle (hObject=0x1b0) returned 1 [0265.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0265.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0265.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.427] lstrlenW (lpString=".doc") returned 4 [0265.427] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString=".docx") returned 5 [0265.427] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0265.427] lstrlenW (lpString=".pdf") returned 4 [0265.427] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString=".xls") returned 4 [0265.427] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString=".xlsx") returned 5 [0265.427] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0265.427] lstrlenW (lpString=".ppt") returned 4 [0265.427] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.427] lstrlenW (lpString=".zip") returned 4 [0265.427] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString=".rar") returned 4 [0265.427] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString=".bz2") returned 4 [0265.427] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.427] lstrlenW (lpString=".7z") returned 3 [0265.427] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.427] lstrlenW (lpString=".dbf") returned 4 [0265.427] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.428] lstrlenW (lpString=".1cd") returned 4 [0265.428] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.428] lstrlenW (lpString=".jpg") returned 4 [0265.428] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.428] lstrlenW (lpString=".doc") returned 4 [0265.428] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString=".docx") returned 5 [0265.428] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0265.428] lstrlenW (lpString=".pdf") returned 4 [0265.428] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString=".xls") returned 4 [0265.428] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString=".xlsx") returned 5 [0265.428] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0265.428] lstrlenW (lpString=".ppt") returned 4 [0265.428] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.428] lstrlenW (lpString=".zip") returned 4 [0265.428] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString=".rar") returned 4 [0265.428] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.428] lstrlenW (lpString=".bz2") returned 4 [0265.428] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.428] lstrlenW (lpString=".7z") returned 3 [0265.429] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.429] lstrlenW (lpString=".dbf") returned 4 [0265.429] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.429] lstrlenW (lpString=".1cd") returned 4 [0265.429] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0265.429] lstrlenW (lpString=".jpg") returned 4 [0265.429] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.429] lstrcmpiW (lpString1=".dat", lpString2=".drweb") returned -1 [0265.429] lstrlenW (lpString="hwrusalm.dat") returned 12 [0265.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.430] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3195696) returned 1 [0265.430] CloseHandle (hObject=0x1b0) returned 1 [0265.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0265.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0265.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.430] lstrlenW (lpString=".doc") returned 4 [0265.430] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.430] lstrlenW (lpString=".docx") returned 5 [0265.430] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0265.430] lstrlenW (lpString=".pdf") returned 4 [0265.430] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.430] lstrlenW (lpString=".xls") returned 4 [0265.430] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.430] lstrlenW (lpString=".xlsx") returned 5 [0265.430] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0265.430] lstrlenW (lpString=".ppt") returned 4 [0265.430] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.431] lstrlenW (lpString=".zip") returned 4 [0265.431] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString=".rar") returned 4 [0265.431] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString=".bz2") returned 4 [0265.431] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.431] lstrlenW (lpString=".7z") returned 3 [0265.431] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.431] lstrlenW (lpString=".dbf") returned 4 [0265.431] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.431] lstrlenW (lpString=".1cd") returned 4 [0265.431] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.431] lstrlenW (lpString=".jpg") returned 4 [0265.431] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.431] lstrlenW (lpString=".doc") returned 4 [0265.431] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString=".docx") returned 5 [0265.431] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0265.431] lstrlenW (lpString=".pdf") returned 4 [0265.431] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.431] lstrlenW (lpString=".xls") returned 4 [0265.431] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.432] lstrlenW (lpString=".xlsx") returned 5 [0265.432] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0265.432] lstrlenW (lpString=".ppt") returned 4 [0265.432] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.432] lstrlenW (lpString=".zip") returned 4 [0265.432] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.432] lstrlenW (lpString=".rar") returned 4 [0265.432] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.432] lstrlenW (lpString=".bz2") returned 4 [0265.432] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.432] lstrlenW (lpString=".7z") returned 3 [0265.432] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.432] lstrlenW (lpString=".dbf") returned 4 [0265.432] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.432] lstrlenW (lpString=".1cd") returned 4 [0265.432] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0265.432] lstrlenW (lpString=".jpg") returned 4 [0265.432] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.432] lstrcmpiW (lpString1=".dat", lpString2=".drweb") returned -1 [0265.433] lstrlenW (lpString="hwrusash.dat") returned 12 [0265.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.433] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4120784) returned 1 [0265.433] CloseHandle (hObject=0x1b0) returned 1 [0265.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0265.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0265.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.434] lstrlenW (lpString=".doc") returned 4 [0265.434] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString=".docx") returned 5 [0265.434] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0265.434] lstrlenW (lpString=".pdf") returned 4 [0265.434] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString=".xls") returned 4 [0265.434] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString=".xlsx") returned 5 [0265.434] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0265.434] lstrlenW (lpString=".ppt") returned 4 [0265.434] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.434] lstrlenW (lpString=".zip") returned 4 [0265.434] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString=".rar") returned 4 [0265.434] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString=".bz2") returned 4 [0265.434] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.434] lstrlenW (lpString=".7z") returned 3 [0265.434] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.434] lstrlenW (lpString=".dbf") returned 4 [0265.434] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.434] lstrlenW (lpString=".1cd") returned 4 [0265.434] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.435] lstrlenW (lpString=".jpg") returned 4 [0265.435] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.435] lstrlenW (lpString=".doc") returned 4 [0265.435] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString=".docx") returned 5 [0265.435] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0265.435] lstrlenW (lpString=".pdf") returned 4 [0265.435] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString=".xls") returned 4 [0265.435] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString=".xlsx") returned 5 [0265.435] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0265.435] lstrlenW (lpString=".ppt") returned 4 [0265.435] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.435] lstrlenW (lpString=".zip") returned 4 [0265.435] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString=".rar") returned 4 [0265.435] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.435] lstrlenW (lpString=".bz2") returned 4 [0265.435] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.435] lstrlenW (lpString=".7z") returned 3 [0265.435] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.435] lstrlenW (lpString=".dbf") returned 4 [0265.436] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.436] lstrlenW (lpString=".1cd") returned 4 [0265.436] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0265.436] lstrlenW (lpString=".jpg") returned 4 [0265.436] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.436] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.436] lstrlenW (lpString="ipscat.xml") returned 10 [0265.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.436] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2592) returned 1 [0265.437] CloseHandle (hObject=0x1b0) returned 1 [0265.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0265.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.437] lstrlenW (lpString=".doc") returned 4 [0265.437] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.437] lstrlenW (lpString=".docx") returned 5 [0265.437] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0265.437] lstrlenW (lpString=".pdf") returned 4 [0265.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.437] lstrlenW (lpString=".xls") returned 4 [0265.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.437] lstrlenW (lpString=".xlsx") returned 5 [0265.438] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0265.438] lstrlenW (lpString=".ppt") returned 4 [0265.438] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.438] lstrlenW (lpString=".zip") returned 4 [0265.438] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.438] lstrlenW (lpString=".rar") returned 4 [0265.438] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString=".bz2") returned 4 [0265.438] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString=".7z") returned 3 [0265.438] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.438] lstrlenW (lpString=".dbf") returned 4 [0265.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.438] lstrlenW (lpString=".1cd") returned 4 [0265.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.438] lstrlenW (lpString=".jpg") returned 4 [0265.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.438] lstrlenW (lpString=".doc") returned 4 [0265.438] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.438] lstrlenW (lpString=".docx") returned 5 [0265.438] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0265.438] lstrlenW (lpString=".pdf") returned 4 [0265.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString=".xls") returned 4 [0265.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString=".xlsx") returned 5 [0265.439] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0265.439] lstrlenW (lpString=".ppt") returned 4 [0265.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.439] lstrlenW (lpString=".zip") returned 4 [0265.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.439] lstrlenW (lpString=".rar") returned 4 [0265.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString=".bz2") returned 4 [0265.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString=".7z") returned 3 [0265.439] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.439] lstrlenW (lpString=".dbf") returned 4 [0265.439] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.439] lstrlenW (lpString=".1cd") returned 4 [0265.439] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0265.439] lstrlenW (lpString=".jpg") returned 4 [0265.439] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.440] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.440] lstrlenW (lpString="ipschs.xml") returned 10 [0265.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.440] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2462) returned 1 [0265.440] CloseHandle (hObject=0x1b0) returned 1 [0265.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0265.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.441] lstrlenW (lpString=".doc") returned 4 [0265.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString=".docx") returned 5 [0265.441] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.441] lstrlenW (lpString=".pdf") returned 4 [0265.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString=".xls") returned 4 [0265.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString=".xlsx") returned 5 [0265.441] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.441] lstrlenW (lpString=".ppt") returned 4 [0265.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.441] lstrlenW (lpString=".zip") returned 4 [0265.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.441] lstrlenW (lpString=".rar") returned 4 [0265.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString=".bz2") returned 4 [0265.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString=".7z") returned 3 [0265.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.441] lstrlenW (lpString=".dbf") returned 4 [0265.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.441] lstrlenW (lpString=".1cd") returned 4 [0265.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.442] lstrlenW (lpString=".jpg") returned 4 [0265.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.442] lstrlenW (lpString=".doc") returned 4 [0265.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString=".docx") returned 5 [0265.442] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0265.442] lstrlenW (lpString=".pdf") returned 4 [0265.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString=".xls") returned 4 [0265.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString=".xlsx") returned 5 [0265.442] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0265.442] lstrlenW (lpString=".ppt") returned 4 [0265.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.442] lstrlenW (lpString=".zip") returned 4 [0265.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.442] lstrlenW (lpString=".rar") returned 4 [0265.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString=".bz2") returned 4 [0265.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.442] lstrlenW (lpString=".7z") returned 3 [0265.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.443] lstrlenW (lpString=".dbf") returned 4 [0265.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.443] lstrlenW (lpString=".1cd") returned 4 [0265.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0265.443] lstrlenW (lpString=".jpg") returned 4 [0265.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.443] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.443] lstrlenW (lpString="ipscht.xml") returned 10 [0265.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0266.480] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2436) returned 1 [0266.480] CloseHandle (hObject=0x190) returned 1 [0266.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0266.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0266.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.481] lstrlenW (lpString=".doc") returned 4 [0266.481] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString=".docx") returned 5 [0266.481] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0266.481] lstrlenW (lpString=".pdf") returned 4 [0266.481] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString=".xls") returned 4 [0266.481] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString=".xlsx") returned 5 [0266.481] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0266.481] lstrlenW (lpString=".ppt") returned 4 [0266.481] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.481] lstrlenW (lpString=".zip") returned 4 [0266.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0266.481] lstrlenW (lpString=".rar") returned 4 [0266.481] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString=".bz2") returned 4 [0266.481] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString=".7z") returned 3 [0266.481] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0266.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.481] lstrlenW (lpString=".dbf") returned 4 [0266.481] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0266.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.482] lstrlenW (lpString=".1cd") returned 4 [0266.482] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.482] lstrlenW (lpString=".jpg") returned 4 [0266.482] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.482] lstrlenW (lpString=".doc") returned 4 [0266.482] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString=".docx") returned 5 [0266.482] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0266.482] lstrlenW (lpString=".pdf") returned 4 [0266.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString=".xls") returned 4 [0266.482] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString=".xlsx") returned 5 [0266.482] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0266.482] lstrlenW (lpString=".ppt") returned 4 [0266.482] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.482] lstrlenW (lpString=".zip") returned 4 [0266.482] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0266.482] lstrlenW (lpString=".rar") returned 4 [0266.482] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0266.482] lstrlenW (lpString=".bz2") returned 4 [0266.483] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0266.483] lstrlenW (lpString=".7z") returned 3 [0266.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0266.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.483] lstrlenW (lpString=".dbf") returned 4 [0266.483] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0266.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.483] lstrlenW (lpString=".1cd") returned 4 [0266.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0266.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0266.483] lstrlenW (lpString=".jpg") returned 4 [0266.483] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0266.483] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.483] lstrlenW (lpString="SETUP.XML") returned 9 [0266.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0266.561] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2624) returned 1 [0266.561] CloseHandle (hObject=0x1a8) returned 1 [0266.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0266.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0266.562] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.562] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0266.562] GetLastError () returned 0x0 [0266.562] ReadFile (in: hFile=0x1a8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xa40, lpOverlapped=0x0) returned 1 [0266.629] WriteFile (in: hFile=0x190, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0266.630] ReadFile (in: hFile=0x1a8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.630] WriteFile (in: hFile=0x190, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0266.630] SetEndOfFile (hFile=0x190) returned 1 [0266.630] CloseHandle (hObject=0x190) returned 1 [0266.633] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.633] SetEndOfFile (hFile=0x1a8) returned 1 [0266.634] CloseHandle (hObject=0x1a8) returned 1 [0266.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.635] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0266.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.635] lstrlenW (lpString=".doc") returned 4 [0266.636] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.636] lstrlenW (lpString=".docx") returned 5 [0266.636] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0266.636] lstrlenW (lpString=".pdf") returned 4 [0266.636] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.636] lstrlenW (lpString=".xls") returned 4 [0266.636] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.636] lstrlenW (lpString=".xlsx") returned 5 [0266.636] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0266.636] lstrlenW (lpString=".ppt") returned 4 [0266.636] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.636] lstrlenW (lpString=".zip") returned 4 [0266.636] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.636] lstrlenW (lpString=".rar") returned 4 [0266.636] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.636] lstrlenW (lpString=".bz2") returned 4 [0266.660] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.660] lstrlenW (lpString=".7z") returned 3 [0266.660] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.660] lstrlenW (lpString=".dbf") returned 4 [0266.660] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.660] lstrlenW (lpString=".1cd") returned 4 [0266.660] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.660] lstrlenW (lpString=".jpg") returned 4 [0266.660] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.661] lstrlenW (lpString=".doc") returned 4 [0266.661] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.661] lstrlenW (lpString=".docx") returned 5 [0266.661] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0266.661] lstrlenW (lpString=".pdf") returned 4 [0266.661] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.661] lstrlenW (lpString=".xls") returned 4 [0266.661] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.661] lstrlenW (lpString=".xlsx") returned 5 [0266.661] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0266.661] lstrlenW (lpString=".ppt") returned 4 [0266.661] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.661] lstrlenW (lpString=".zip") returned 4 [0266.661] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.661] lstrlenW (lpString=".rar") returned 4 [0266.661] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.661] lstrlenW (lpString=".bz2") returned 4 [0266.661] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.661] lstrlenW (lpString=".7z") returned 3 [0266.661] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.661] lstrlenW (lpString=".dbf") returned 4 [0266.662] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.662] lstrlenW (lpString=".1cd") returned 4 [0266.662] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0266.662] lstrlenW (lpString=".jpg") returned 4 [0266.662] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.662] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.662] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0266.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.662] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1231) returned 1 [0266.663] CloseHandle (hObject=0x1c4) returned 1 [0266.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0266.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.663] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.663] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0266.668] GetLastError () returned 0x0 [0266.668] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0266.697] WriteFile (in: hFile=0x1bc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0266.698] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.698] WriteFile (in: hFile=0x1bc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0266.698] SetEndOfFile (hFile=0x1bc) returned 1 [0266.698] CloseHandle (hObject=0x1bc) returned 1 [0266.699] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.699] SetEndOfFile (hFile=0x1c4) returned 1 [0266.700] CloseHandle (hObject=0x1c4) returned 1 [0266.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.701] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0266.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.702] lstrlenW (lpString=".doc") returned 4 [0266.702] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.702] lstrlenW (lpString=".docx") returned 5 [0266.702] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0266.702] lstrlenW (lpString=".pdf") returned 4 [0266.702] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.702] lstrlenW (lpString=".xls") returned 4 [0266.702] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.702] lstrlenW (lpString=".xlsx") returned 5 [0266.702] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0266.702] lstrlenW (lpString=".ppt") returned 4 [0266.702] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.702] lstrlenW (lpString=".zip") returned 4 [0266.702] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.702] lstrlenW (lpString=".rar") returned 4 [0266.702] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.702] lstrlenW (lpString=".bz2") returned 4 [0266.702] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.702] lstrlenW (lpString=".7z") returned 3 [0266.702] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.703] lstrlenW (lpString=".dbf") returned 4 [0266.703] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.703] lstrlenW (lpString=".1cd") returned 4 [0266.703] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.703] lstrlenW (lpString=".jpg") returned 4 [0266.703] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.703] lstrlenW (lpString=".doc") returned 4 [0266.703] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.703] lstrlenW (lpString=".docx") returned 5 [0266.703] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0266.703] lstrlenW (lpString=".pdf") returned 4 [0266.703] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.703] lstrlenW (lpString=".xls") returned 4 [0266.703] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.703] lstrlenW (lpString=".xlsx") returned 5 [0266.703] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0266.703] lstrlenW (lpString=".ppt") returned 4 [0266.703] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.704] lstrlenW (lpString=".zip") returned 4 [0266.704] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.704] lstrlenW (lpString=".rar") returned 4 [0266.704] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.704] lstrlenW (lpString=".bz2") returned 4 [0266.704] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.704] lstrlenW (lpString=".7z") returned 3 [0266.704] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.704] lstrlenW (lpString=".dbf") returned 4 [0266.704] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.704] lstrlenW (lpString=".1cd") returned 4 [0266.704] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0266.704] lstrlenW (lpString=".jpg") returned 4 [0266.704] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.705] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.706] lstrlenW (lpString="SETUP.XML") returned 9 [0266.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.708] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1852) returned 1 [0266.708] CloseHandle (hObject=0x1c4) returned 1 [0266.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0266.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.708] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.709] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0266.709] GetLastError () returned 0x0 [0266.709] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x73c, lpOverlapped=0x0) returned 1 [0266.718] WriteFile (in: hFile=0x1bc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x740, lpOverlapped=0x0) returned 1 [0266.719] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.719] WriteFile (in: hFile=0x1bc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0266.719] SetEndOfFile (hFile=0x1bc) returned 1 [0266.719] CloseHandle (hObject=0x1bc) returned 1 [0266.720] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.720] SetEndOfFile (hFile=0x1c4) returned 1 [0266.721] CloseHandle (hObject=0x1c4) returned 1 [0266.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0266.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.722] lstrlenW (lpString=".doc") returned 4 [0266.722] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString=".docx") returned 5 [0266.722] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0266.722] lstrlenW (lpString=".pdf") returned 4 [0266.722] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString=".xls") returned 4 [0266.722] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString=".xlsx") returned 5 [0266.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0266.722] lstrlenW (lpString=".ppt") returned 4 [0266.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.722] lstrlenW (lpString=".zip") returned 4 [0266.722] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.722] lstrlenW (lpString=".rar") returned 4 [0266.722] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString=".bz2") returned 4 [0266.722] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString=".7z") returned 3 [0266.722] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.722] lstrlenW (lpString=".dbf") returned 4 [0266.722] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.722] lstrlenW (lpString=".1cd") returned 4 [0266.723] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.723] lstrlenW (lpString=".jpg") returned 4 [0266.723] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.723] lstrlenW (lpString=".doc") returned 4 [0266.723] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString=".docx") returned 5 [0266.723] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0266.723] lstrlenW (lpString=".pdf") returned 4 [0266.723] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString=".xls") returned 4 [0266.723] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString=".xlsx") returned 5 [0266.723] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0266.723] lstrlenW (lpString=".ppt") returned 4 [0266.723] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.723] lstrlenW (lpString=".zip") returned 4 [0266.723] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.723] lstrlenW (lpString=".rar") returned 4 [0266.723] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString=".bz2") returned 4 [0266.723] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.723] lstrlenW (lpString=".7z") returned 3 [0266.723] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.723] lstrlenW (lpString=".dbf") returned 4 [0266.723] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.724] lstrlenW (lpString=".1cd") returned 4 [0266.724] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0266.724] lstrlenW (lpString=".jpg") returned 4 [0266.724] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.724] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.724] lstrlenW (lpString="BRANDING.XML") returned 12 [0266.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.726] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=596341) returned 1 [0266.726] CloseHandle (hObject=0x1c4) returned 1 [0266.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0266.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.727] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.727] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0266.728] GetLastError () returned 0x0 [0266.728] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0266.766] WriteFile (in: hFile=0x1bc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0266.776] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.776] WriteFile (in: hFile=0x1bc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.777] SetEndOfFile (hFile=0x1bc) returned 1 [0266.777] CloseHandle (hObject=0x1bc) returned 1 [0266.781] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.781] SetEndOfFile (hFile=0x1c4) returned 1 [0266.788] CloseHandle (hObject=0x1c4) returned 1 [0266.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0266.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.789] lstrlenW (lpString=".doc") returned 4 [0266.789] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.789] lstrlenW (lpString=".docx") returned 5 [0266.789] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0266.789] lstrlenW (lpString=".pdf") returned 4 [0266.789] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.789] lstrlenW (lpString=".xls") returned 4 [0266.789] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.789] lstrlenW (lpString=".xlsx") returned 5 [0266.789] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0266.789] lstrlenW (lpString=".ppt") returned 4 [0266.789] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.790] lstrlenW (lpString=".zip") returned 4 [0266.790] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.790] lstrlenW (lpString=".rar") returned 4 [0266.790] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString=".bz2") returned 4 [0266.790] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString=".7z") returned 3 [0266.790] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.790] lstrlenW (lpString=".dbf") returned 4 [0266.790] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.790] lstrlenW (lpString=".1cd") returned 4 [0266.790] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.790] lstrlenW (lpString=".jpg") returned 4 [0266.790] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.790] lstrlenW (lpString=".doc") returned 4 [0266.790] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString=".docx") returned 5 [0266.790] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0266.790] lstrlenW (lpString=".pdf") returned 4 [0266.790] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.790] lstrlenW (lpString=".xls") returned 4 [0266.791] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.791] lstrlenW (lpString=".xlsx") returned 5 [0266.791] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0266.791] lstrlenW (lpString=".ppt") returned 4 [0266.791] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.791] lstrlenW (lpString=".zip") returned 4 [0266.791] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.791] lstrlenW (lpString=".rar") returned 4 [0266.791] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.791] lstrlenW (lpString=".bz2") returned 4 [0266.791] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.791] lstrlenW (lpString=".7z") returned 3 [0266.791] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.791] lstrlenW (lpString=".dbf") returned 4 [0266.791] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.791] lstrlenW (lpString=".1cd") returned 4 [0266.791] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0266.791] lstrlenW (lpString=".jpg") returned 4 [0266.791] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.791] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0266.791] lstrlenW (lpString="OCT.CHM") returned 7 [0266.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0267.212] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=71236) returned 1 [0267.212] CloseHandle (hObject=0x1ec) returned 1 [0267.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0267.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0267.213] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.213] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0267.213] GetLastError () returned 0x0 [0267.213] ReadFile (in: hFile=0x1ec, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x11644, lpOverlapped=0x0) returned 1 [0267.271] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0267.273] ReadFile (in: hFile=0x1ec, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.273] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0267.273] SetEndOfFile (hFile=0x1f0) returned 1 [0267.274] CloseHandle (hObject=0x1f0) returned 1 [0267.284] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.284] SetEndOfFile (hFile=0x1ec) returned 1 [0267.305] CloseHandle (hObject=0x1ec) returned 1 [0267.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.305] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0267.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString=".doc") returned 4 [0267.310] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString=".docx") returned 5 [0267.310] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0267.310] lstrlenW (lpString=".pdf") returned 4 [0267.310] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString=".xls") returned 4 [0267.310] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString=".xlsx") returned 5 [0267.310] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0267.310] lstrlenW (lpString=".ppt") returned 4 [0267.310] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString=".zip") returned 4 [0267.310] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString=".rar") returned 4 [0267.310] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString=".bz2") returned 4 [0267.310] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.310] lstrlenW (lpString=".7z") returned 3 [0267.310] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString=".dbf") returned 4 [0267.310] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString=".1cd") returned 4 [0267.310] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString=".jpg") returned 4 [0267.310] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.310] lstrlenW (lpString=".doc") returned 4 [0267.311] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString=".docx") returned 5 [0267.311] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0267.311] lstrlenW (lpString=".pdf") returned 4 [0267.311] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString=".xls") returned 4 [0267.311] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString=".xlsx") returned 5 [0267.311] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0267.311] lstrlenW (lpString=".ppt") returned 4 [0267.311] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.311] lstrlenW (lpString=".zip") returned 4 [0267.311] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString=".rar") returned 4 [0267.311] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString=".bz2") returned 4 [0267.311] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.311] lstrlenW (lpString=".7z") returned 3 [0267.311] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.311] lstrlenW (lpString=".dbf") returned 4 [0267.311] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.311] lstrlenW (lpString=".1cd") returned 4 [0267.311] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0267.311] lstrlenW (lpString=".jpg") returned 4 [0267.311] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.312] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0267.312] lstrlenW (lpString="PSS10R.CHM") returned 10 [0267.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.320] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=27195) returned 1 [0267.321] CloseHandle (hObject=0x1f8) returned 1 [0267.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0267.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0267.321] GetLastError () returned 0x0 [0267.321] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0267.326] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0267.327] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.327] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0267.327] SetEndOfFile (hFile=0x1fc) returned 1 [0267.327] CloseHandle (hObject=0x1fc) returned 1 [0267.328] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.328] SetEndOfFile (hFile=0x1f8) returned 1 [0267.329] CloseHandle (hObject=0x1f8) returned 1 [0267.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.329] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0267.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.329] lstrlenW (lpString=".doc") returned 4 [0267.329] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.329] lstrlenW (lpString=".docx") returned 5 [0267.329] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0267.329] lstrlenW (lpString=".pdf") returned 4 [0267.329] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.329] lstrlenW (lpString=".xls") returned 4 [0267.330] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString=".xlsx") returned 5 [0267.330] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0267.330] lstrlenW (lpString=".ppt") returned 4 [0267.330] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.330] lstrlenW (lpString=".zip") returned 4 [0267.330] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString=".rar") returned 4 [0267.330] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString=".bz2") returned 4 [0267.330] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.330] lstrlenW (lpString=".7z") returned 3 [0267.330] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.330] lstrlenW (lpString=".dbf") returned 4 [0267.330] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.330] lstrlenW (lpString=".1cd") returned 4 [0267.330] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.330] lstrlenW (lpString=".jpg") returned 4 [0267.330] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.330] lstrlenW (lpString=".doc") returned 4 [0267.330] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.330] lstrlenW (lpString=".docx") returned 5 [0267.330] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0267.331] lstrlenW (lpString=".pdf") returned 4 [0267.331] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.331] lstrlenW (lpString=".xls") returned 4 [0267.331] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.331] lstrlenW (lpString=".xlsx") returned 5 [0267.331] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0267.331] lstrlenW (lpString=".ppt") returned 4 [0267.331] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.331] lstrlenW (lpString=".zip") returned 4 [0267.331] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.331] lstrlenW (lpString=".rar") returned 4 [0267.331] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.331] lstrlenW (lpString=".bz2") returned 4 [0267.331] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.331] lstrlenW (lpString=".7z") returned 3 [0267.331] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.331] lstrlenW (lpString=".dbf") returned 4 [0267.331] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.331] lstrlenW (lpString=".1cd") returned 4 [0267.331] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0267.331] lstrlenW (lpString=".jpg") returned 4 [0267.331] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.331] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.331] lstrlenW (lpString="SETUP.XML") returned 9 [0267.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.332] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9352) returned 1 [0267.332] CloseHandle (hObject=0x1f8) returned 1 [0267.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0267.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0267.332] GetLastError () returned 0x0 [0267.332] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x2488, lpOverlapped=0x0) returned 1 [0267.388] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0267.389] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.389] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0267.389] SetEndOfFile (hFile=0x1fc) returned 1 [0267.389] CloseHandle (hObject=0x1fc) returned 1 [0267.390] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.390] SetEndOfFile (hFile=0x1f8) returned 1 [0267.391] CloseHandle (hObject=0x1f8) returned 1 [0267.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.391] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0267.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.391] lstrlenW (lpString=".doc") returned 4 [0267.391] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.391] lstrlenW (lpString=".docx") returned 5 [0267.391] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0267.391] lstrlenW (lpString=".pdf") returned 4 [0267.391] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.391] lstrlenW (lpString=".xls") returned 4 [0267.391] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.391] lstrlenW (lpString=".xlsx") returned 5 [0267.391] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0267.392] lstrlenW (lpString=".ppt") returned 4 [0267.392] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.392] lstrlenW (lpString=".zip") returned 4 [0267.392] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.392] lstrlenW (lpString=".rar") returned 4 [0267.392] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString=".bz2") returned 4 [0267.392] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString=".7z") returned 3 [0267.392] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.392] lstrlenW (lpString=".dbf") returned 4 [0267.392] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.392] lstrlenW (lpString=".1cd") returned 4 [0267.392] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.392] lstrlenW (lpString=".jpg") returned 4 [0267.392] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.392] lstrlenW (lpString=".doc") returned 4 [0267.392] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString=".docx") returned 5 [0267.392] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0267.392] lstrlenW (lpString=".pdf") returned 4 [0267.392] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString=".xls") returned 4 [0267.392] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.392] lstrlenW (lpString=".xlsx") returned 5 [0267.393] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0267.393] lstrlenW (lpString=".ppt") returned 4 [0267.393] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.393] lstrlenW (lpString=".zip") returned 4 [0267.393] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.393] lstrlenW (lpString=".rar") returned 4 [0267.393] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.393] lstrlenW (lpString=".bz2") returned 4 [0267.393] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.393] lstrlenW (lpString=".7z") returned 3 [0267.393] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.393] lstrlenW (lpString=".dbf") returned 4 [0267.393] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.393] lstrlenW (lpString=".1cd") returned 4 [0267.393] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0267.393] lstrlenW (lpString=".jpg") returned 4 [0267.393] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.393] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.393] lstrlenW (lpString="Office32MUI.XML") returned 15 [0267.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.394] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1383) returned 1 [0267.394] CloseHandle (hObject=0x1f8) returned 1 [0267.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0267.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.394] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.395] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0267.396] GetLastError () returned 0x0 [0267.396] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x567, lpOverlapped=0x0) returned 1 [0267.405] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0267.406] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.406] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0267.406] SetEndOfFile (hFile=0x1fc) returned 1 [0267.406] CloseHandle (hObject=0x1fc) returned 1 [0267.407] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.407] SetEndOfFile (hFile=0x1f8) returned 1 [0267.408] CloseHandle (hObject=0x1f8) returned 1 [0267.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.408] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0267.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.408] lstrlenW (lpString=".doc") returned 4 [0267.408] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.408] lstrlenW (lpString=".docx") returned 5 [0267.408] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.409] lstrlenW (lpString=".pdf") returned 4 [0267.409] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.409] lstrlenW (lpString=".xls") returned 4 [0267.409] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.409] lstrlenW (lpString=".xlsx") returned 5 [0267.409] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.409] lstrlenW (lpString=".ppt") returned 4 [0267.409] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.409] lstrlenW (lpString=".zip") returned 4 [0267.409] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.409] lstrlenW (lpString=".rar") returned 4 [0267.409] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.409] lstrlenW (lpString=".bz2") returned 4 [0267.409] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.409] lstrlenW (lpString=".7z") returned 3 [0267.409] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.409] lstrlenW (lpString=".dbf") returned 4 [0267.409] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.409] lstrlenW (lpString=".1cd") returned 4 [0267.409] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.410] lstrlenW (lpString=".jpg") returned 4 [0267.410] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.410] lstrlenW (lpString=".doc") returned 4 [0267.410] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString=".docx") returned 5 [0267.410] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.410] lstrlenW (lpString=".pdf") returned 4 [0267.410] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString=".xls") returned 4 [0267.410] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString=".xlsx") returned 5 [0267.410] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.410] lstrlenW (lpString=".ppt") returned 4 [0267.410] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.410] lstrlenW (lpString=".zip") returned 4 [0267.410] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.410] lstrlenW (lpString=".rar") returned 4 [0267.410] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString=".bz2") returned 4 [0267.410] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString=".7z") returned 3 [0267.410] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.410] lstrlenW (lpString=".dbf") returned 4 [0267.410] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.411] lstrlenW (lpString=".1cd") returned 4 [0267.411] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0267.411] lstrlenW (lpString=".jpg") returned 4 [0267.411] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.411] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.411] lstrlenW (lpString="Office32WW.XML") returned 14 [0267.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.411] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4274) returned 1 [0267.411] CloseHandle (hObject=0x1f8) returned 1 [0267.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0267.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.412] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.412] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0267.412] GetLastError () returned 0x0 [0267.412] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0267.783] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0267.784] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.784] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0267.784] SetEndOfFile (hFile=0x1fc) returned 1 [0267.784] CloseHandle (hObject=0x1fc) returned 1 [0267.785] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.785] SetEndOfFile (hFile=0x1f8) returned 1 [0267.787] CloseHandle (hObject=0x1f8) returned 1 [0267.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.788] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.788] lstrlenW (lpString=".doc") returned 4 [0267.788] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString=".docx") returned 5 [0267.788] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0267.788] lstrlenW (lpString=".pdf") returned 4 [0267.788] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString=".xls") returned 4 [0267.788] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString=".xlsx") returned 5 [0267.788] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0267.788] lstrlenW (lpString=".ppt") returned 4 [0267.788] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.788] lstrlenW (lpString=".zip") returned 4 [0267.788] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.788] lstrlenW (lpString=".rar") returned 4 [0267.788] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString=".bz2") returned 4 [0267.788] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString=".7z") returned 3 [0267.788] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.788] lstrlenW (lpString=".dbf") returned 4 [0267.788] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".1cd") returned 4 [0267.789] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".jpg") returned 4 [0267.789] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".doc") returned 4 [0267.789] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString=".docx") returned 5 [0267.789] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0267.789] lstrlenW (lpString=".pdf") returned 4 [0267.789] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString=".xls") returned 4 [0267.789] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString=".xlsx") returned 5 [0267.789] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0267.789] lstrlenW (lpString=".ppt") returned 4 [0267.789] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".zip") returned 4 [0267.789] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.789] lstrlenW (lpString=".rar") returned 4 [0267.789] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString=".bz2") returned 4 [0267.789] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString=".7z") returned 3 [0267.789] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".dbf") returned 4 [0267.789] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".1cd") returned 4 [0267.789] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0267.789] lstrlenW (lpString=".jpg") returned 4 [0267.789] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.790] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.790] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0267.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.790] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3186) returned 1 [0267.790] CloseHandle (hObject=0x1f8) returned 1 [0267.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0267.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0267.790] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.790] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0268.420] GetLastError () returned 0x0 [0268.420] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xc72, lpOverlapped=0x0) returned 1 [0268.436] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0268.437] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.437] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0268.437] SetEndOfFile (hFile=0x164) returned 1 [0268.437] CloseHandle (hObject=0x164) returned 1 [0268.438] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.438] SetEndOfFile (hFile=0x1f8) returned 1 [0268.439] CloseHandle (hObject=0x1f8) returned 1 [0268.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0268.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.440] lstrlenW (lpString=".doc") returned 4 [0268.440] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.440] lstrlenW (lpString=".docx") returned 5 [0268.440] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0268.440] lstrlenW (lpString=".pdf") returned 4 [0268.440] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.440] lstrlenW (lpString=".xls") returned 4 [0268.440] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.440] lstrlenW (lpString=".xlsx") returned 5 [0268.440] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0268.440] lstrlenW (lpString=".ppt") returned 4 [0268.440] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.440] lstrlenW (lpString=".zip") returned 4 [0268.440] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.440] lstrlenW (lpString=".rar") returned 4 [0268.440] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.440] lstrlenW (lpString=".bz2") returned 4 [0268.440] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString=".7z") returned 3 [0268.441] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.441] lstrlenW (lpString=".dbf") returned 4 [0268.441] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.441] lstrlenW (lpString=".1cd") returned 4 [0268.441] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.441] lstrlenW (lpString=".jpg") returned 4 [0268.441] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.441] lstrlenW (lpString=".doc") returned 4 [0268.441] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString=".docx") returned 5 [0268.441] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0268.441] lstrlenW (lpString=".pdf") returned 4 [0268.441] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString=".xls") returned 4 [0268.441] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString=".xlsx") returned 5 [0268.441] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0268.441] lstrlenW (lpString=".ppt") returned 4 [0268.441] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.441] lstrlenW (lpString=".zip") returned 4 [0268.441] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.442] lstrlenW (lpString=".rar") returned 4 [0268.442] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.442] lstrlenW (lpString=".bz2") returned 4 [0268.442] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.442] lstrlenW (lpString=".7z") returned 3 [0268.442] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.442] lstrlenW (lpString=".dbf") returned 4 [0268.442] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.442] lstrlenW (lpString=".1cd") returned 4 [0268.442] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0268.442] lstrlenW (lpString=".jpg") returned 4 [0268.442] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.442] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.442] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0268.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0268.443] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1452) returned 1 [0268.443] CloseHandle (hObject=0x1f8) returned 1 [0268.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0268.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0268.443] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.443] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0268.445] GetLastError () returned 0x0 [0268.445] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0268.524] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0268.525] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.525] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0268.526] SetEndOfFile (hFile=0x164) returned 1 [0268.526] CloseHandle (hObject=0x164) returned 1 [0268.529] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.529] SetEndOfFile (hFile=0x1f8) returned 1 [0268.530] CloseHandle (hObject=0x1f8) returned 1 [0268.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0268.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.531] lstrlenW (lpString=".doc") returned 4 [0268.531] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.531] lstrlenW (lpString=".docx") returned 5 [0268.531] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0268.531] lstrlenW (lpString=".pdf") returned 4 [0268.531] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.531] lstrlenW (lpString=".xls") returned 4 [0268.531] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.531] lstrlenW (lpString=".xlsx") returned 5 [0268.532] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0268.532] lstrlenW (lpString=".ppt") returned 4 [0268.532] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.532] lstrlenW (lpString=".zip") returned 4 [0268.532] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.532] lstrlenW (lpString=".rar") returned 4 [0268.532] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.532] lstrlenW (lpString=".bz2") returned 4 [0268.532] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.532] lstrlenW (lpString=".7z") returned 3 [0268.532] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.532] lstrlenW (lpString=".dbf") returned 4 [0268.532] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.532] lstrlenW (lpString=".1cd") returned 4 [0268.532] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.532] lstrlenW (lpString=".jpg") returned 4 [0268.532] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.533] lstrlenW (lpString=".doc") returned 4 [0268.533] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.533] lstrlenW (lpString=".docx") returned 5 [0268.533] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0268.533] lstrlenW (lpString=".pdf") returned 4 [0268.533] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.533] lstrlenW (lpString=".xls") returned 4 [0268.533] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.533] lstrlenW (lpString=".xlsx") returned 5 [0268.533] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0268.534] lstrlenW (lpString=".ppt") returned 4 [0268.534] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.534] lstrlenW (lpString=".zip") returned 4 [0268.534] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.534] lstrlenW (lpString=".rar") returned 4 [0268.534] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.534] lstrlenW (lpString=".bz2") returned 4 [0268.534] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.534] lstrlenW (lpString=".7z") returned 3 [0268.535] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.535] lstrlenW (lpString=".dbf") returned 4 [0268.535] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.535] lstrlenW (lpString=".1cd") returned 4 [0268.535] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0268.535] lstrlenW (lpString=".jpg") returned 4 [0268.535] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.535] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.535] lstrlenW (lpString="Proof.XML") returned 9 [0268.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0268.545] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1457) returned 1 [0268.545] CloseHandle (hObject=0x1f8) returned 1 [0268.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0268.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0268.546] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.546] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0268.547] GetLastError () returned 0x0 [0268.547] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0268.589] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0268.591] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.591] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.591] SetEndOfFile (hFile=0x164) returned 1 [0268.591] CloseHandle (hObject=0x164) returned 1 [0268.593] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.593] SetEndOfFile (hFile=0x1f8) returned 1 [0268.594] CloseHandle (hObject=0x1f8) returned 1 [0268.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0268.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.595] lstrlenW (lpString=".doc") returned 4 [0268.595] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.595] lstrlenW (lpString=".docx") returned 5 [0268.596] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0268.596] lstrlenW (lpString=".pdf") returned 4 [0268.596] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.596] lstrlenW (lpString=".xls") returned 4 [0268.596] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.596] lstrlenW (lpString=".xlsx") returned 5 [0268.596] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0268.596] lstrlenW (lpString=".ppt") returned 4 [0268.596] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.596] lstrlenW (lpString=".zip") returned 4 [0268.596] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.596] lstrlenW (lpString=".rar") returned 4 [0268.596] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.596] lstrlenW (lpString=".bz2") returned 4 [0268.596] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.596] lstrlenW (lpString=".7z") returned 3 [0268.596] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.596] lstrlenW (lpString=".dbf") returned 4 [0268.596] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.596] lstrlenW (lpString=".1cd") returned 4 [0268.597] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.597] lstrlenW (lpString=".jpg") returned 4 [0268.597] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.597] lstrlenW (lpString=".doc") returned 4 [0268.597] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.597] lstrlenW (lpString=".docx") returned 5 [0268.597] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0268.597] lstrlenW (lpString=".pdf") returned 4 [0268.597] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.597] lstrlenW (lpString=".xls") returned 4 [0268.597] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.597] lstrlenW (lpString=".xlsx") returned 5 [0268.597] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0268.597] lstrlenW (lpString=".ppt") returned 4 [0268.597] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.597] lstrlenW (lpString=".zip") returned 4 [0268.598] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.598] lstrlenW (lpString=".rar") returned 4 [0268.598] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.598] lstrlenW (lpString=".bz2") returned 4 [0268.598] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.598] lstrlenW (lpString=".7z") returned 3 [0268.598] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.598] lstrlenW (lpString=".dbf") returned 4 [0268.598] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.598] lstrlenW (lpString=".1cd") returned 4 [0268.598] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0268.598] lstrlenW (lpString=".jpg") returned 4 [0268.598] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.598] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.599] lstrlenW (lpString="Proof.XML") returned 9 [0268.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0268.599] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1458) returned 1 [0268.599] CloseHandle (hObject=0x1f8) returned 1 [0268.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0268.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0268.600] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.600] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0268.600] GetLastError () returned 0x0 [0268.600] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0268.795] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0268.964] ReadFile (in: hFile=0x1f8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.964] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.964] SetEndOfFile (hFile=0x164) returned 1 [0268.964] CloseHandle (hObject=0x164) returned 1 [0268.965] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.965] SetEndOfFile (hFile=0x1f8) returned 1 [0268.966] CloseHandle (hObject=0x1f8) returned 1 [0268.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0268.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.967] lstrlenW (lpString=".doc") returned 4 [0268.967] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.967] lstrlenW (lpString=".docx") returned 5 [0268.967] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0268.967] lstrlenW (lpString=".pdf") returned 4 [0268.967] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.967] lstrlenW (lpString=".xls") returned 4 [0268.968] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString=".xlsx") returned 5 [0268.968] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0268.968] lstrlenW (lpString=".ppt") returned 4 [0268.968] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.968] lstrlenW (lpString=".zip") returned 4 [0268.968] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.968] lstrlenW (lpString=".rar") returned 4 [0268.968] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString=".bz2") returned 4 [0268.968] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString=".7z") returned 3 [0268.968] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.968] lstrlenW (lpString=".dbf") returned 4 [0268.968] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.968] lstrlenW (lpString=".1cd") returned 4 [0268.968] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.968] lstrlenW (lpString=".jpg") returned 4 [0268.968] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.969] lstrlenW (lpString=".doc") returned 4 [0268.969] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString=".docx") returned 5 [0268.969] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0268.969] lstrlenW (lpString=".pdf") returned 4 [0268.969] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString=".xls") returned 4 [0268.969] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString=".xlsx") returned 5 [0268.969] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0268.969] lstrlenW (lpString=".ppt") returned 4 [0268.969] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.969] lstrlenW (lpString=".zip") returned 4 [0268.969] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.969] lstrlenW (lpString=".rar") returned 4 [0268.969] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString=".bz2") returned 4 [0268.969] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString=".7z") returned 3 [0268.969] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.969] lstrlenW (lpString=".dbf") returned 4 [0268.969] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.969] lstrlenW (lpString=".1cd") returned 4 [0268.969] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0268.969] lstrlenW (lpString=".jpg") returned 4 [0268.970] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.970] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.970] lstrlenW (lpString="SETUP.XML") returned 9 [0268.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0269.381] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=31094) returned 1 [0269.381] CloseHandle (hObject=0x1fc) returned 1 [0269.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0269.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0269.382] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.382] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0269.382] GetLastError () returned 0x0 [0269.382] ReadFile (in: hFile=0x1fc, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0269.402] WriteFile (in: hFile=0x1e8, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0269.404] ReadFile (in: hFile=0x1fc, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.404] WriteFile (in: hFile=0x1e8, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0269.404] SetEndOfFile (hFile=0x1e8) returned 1 [0269.667] CloseHandle (hObject=0x1e8) returned 1 [0269.668] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.668] SetEndOfFile (hFile=0x1fc) returned 1 [0269.669] CloseHandle (hObject=0x1fc) returned 1 [0269.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.670] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0269.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.670] lstrlenW (lpString=".doc") returned 4 [0269.670] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.670] lstrlenW (lpString=".docx") returned 5 [0269.670] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.670] lstrlenW (lpString=".pdf") returned 4 [0269.670] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.670] lstrlenW (lpString=".xls") returned 4 [0269.670] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.670] lstrlenW (lpString=".xlsx") returned 5 [0269.670] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.670] lstrlenW (lpString=".ppt") returned 4 [0269.670] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.670] lstrlenW (lpString=".zip") returned 4 [0269.670] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.670] lstrlenW (lpString=".rar") returned 4 [0269.670] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.670] lstrlenW (lpString=".bz2") returned 4 [0269.670] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString=".7z") returned 3 [0269.671] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.671] lstrlenW (lpString=".dbf") returned 4 [0269.671] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.671] lstrlenW (lpString=".1cd") returned 4 [0269.671] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.671] lstrlenW (lpString=".jpg") returned 4 [0269.671] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.671] lstrlenW (lpString=".doc") returned 4 [0269.671] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString=".docx") returned 5 [0269.671] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.671] lstrlenW (lpString=".pdf") returned 4 [0269.671] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString=".xls") returned 4 [0269.671] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString=".xlsx") returned 5 [0269.671] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.671] lstrlenW (lpString=".ppt") returned 4 [0269.671] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.671] lstrlenW (lpString=".zip") returned 4 [0269.671] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.671] lstrlenW (lpString=".rar") returned 4 [0269.671] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.672] lstrlenW (lpString=".bz2") returned 4 [0269.672] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.672] lstrlenW (lpString=".7z") returned 3 [0269.672] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.672] lstrlenW (lpString=".dbf") returned 4 [0269.672] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.672] lstrlenW (lpString=".1cd") returned 4 [0269.672] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0269.672] lstrlenW (lpString=".jpg") returned 4 [0269.672] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.672] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.672] lstrlenW (lpString="SETUP.XML") returned 9 [0269.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0269.673] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=6241) returned 1 [0269.673] CloseHandle (hObject=0x1fc) returned 1 [0269.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0269.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0269.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0269.674] GetLastError () returned 0x0 [0269.674] ReadFile (in: hFile=0x1fc, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x1861, lpOverlapped=0x0) returned 1 [0269.682] WriteFile (in: hFile=0x1e8, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0269.683] ReadFile (in: hFile=0x1fc, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.683] WriteFile (in: hFile=0x1e8, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0269.683] SetEndOfFile (hFile=0x1e8) returned 1 [0269.684] CloseHandle (hObject=0x1e8) returned 1 [0269.684] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.684] SetEndOfFile (hFile=0x1fc) returned 1 [0269.685] CloseHandle (hObject=0x1fc) returned 1 [0269.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.686] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0269.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.686] lstrlenW (lpString=".doc") returned 4 [0269.686] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.686] lstrlenW (lpString=".docx") returned 5 [0269.686] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.686] lstrlenW (lpString=".pdf") returned 4 [0269.686] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.686] lstrlenW (lpString=".xls") returned 4 [0269.686] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.686] lstrlenW (lpString=".xlsx") returned 5 [0269.686] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.686] lstrlenW (lpString=".ppt") returned 4 [0269.687] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.687] lstrlenW (lpString=".zip") returned 4 [0269.687] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.687] lstrlenW (lpString=".rar") returned 4 [0269.687] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.687] lstrlenW (lpString=".bz2") returned 4 [0269.687] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.687] lstrlenW (lpString=".7z") returned 3 [0269.687] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.687] lstrlenW (lpString=".dbf") returned 4 [0269.687] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.687] lstrlenW (lpString=".1cd") returned 4 [0269.687] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.687] lstrlenW (lpString=".jpg") returned 4 [0269.687] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.687] lstrlenW (lpString=".doc") returned 4 [0269.687] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString=".docx") returned 5 [0269.688] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.688] lstrlenW (lpString=".pdf") returned 4 [0269.688] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString=".xls") returned 4 [0269.688] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString=".xlsx") returned 5 [0269.688] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.688] lstrlenW (lpString=".ppt") returned 4 [0269.688] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.688] lstrlenW (lpString=".zip") returned 4 [0269.688] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.688] lstrlenW (lpString=".rar") returned 4 [0269.688] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString=".bz2") returned 4 [0269.688] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString=".7z") returned 3 [0269.688] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.688] lstrlenW (lpString=".dbf") returned 4 [0269.688] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.688] lstrlenW (lpString=".1cd") returned 4 [0269.688] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0269.688] lstrlenW (lpString=".jpg") returned 4 [0269.688] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.689] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.689] lstrlenW (lpString="VisioMUI.XML") returned 12 [0269.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0269.690] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=9503) returned 1 [0269.690] CloseHandle (hObject=0x1fc) returned 1 [0269.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0269.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0269.690] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.690] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0269.699] GetLastError () returned 0x0 [0269.699] ReadFile (in: hFile=0x1fc, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x251f, lpOverlapped=0x0) returned 1 [0269.709] WriteFile (in: hFile=0x1f8, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0269.710] ReadFile (in: hFile=0x1fc, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.710] WriteFile (in: hFile=0x1f8, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.710] SetEndOfFile (hFile=0x1f8) returned 1 [0269.711] CloseHandle (hObject=0x1f8) returned 1 [0269.711] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.711] SetEndOfFile (hFile=0x1fc) returned 1 [0269.713] CloseHandle (hObject=0x1fc) returned 1 [0269.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0269.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.713] lstrlenW (lpString=".doc") returned 4 [0269.713] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.713] lstrlenW (lpString=".docx") returned 5 [0269.713] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0269.713] lstrlenW (lpString=".pdf") returned 4 [0269.713] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.713] lstrlenW (lpString=".xls") returned 4 [0269.713] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.714] lstrlenW (lpString=".xlsx") returned 5 [0269.714] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0269.714] lstrlenW (lpString=".ppt") returned 4 [0269.714] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.714] lstrlenW (lpString=".zip") returned 4 [0269.714] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.714] lstrlenW (lpString=".rar") returned 4 [0269.714] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.714] lstrlenW (lpString=".bz2") returned 4 [0269.714] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.714] lstrlenW (lpString=".7z") returned 3 [0269.714] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.714] lstrlenW (lpString=".dbf") returned 4 [0269.714] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.714] lstrlenW (lpString=".1cd") returned 4 [0269.714] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.714] lstrlenW (lpString=".jpg") returned 4 [0269.715] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.715] lstrlenW (lpString=".doc") returned 4 [0269.715] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString=".docx") returned 5 [0269.715] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0269.715] lstrlenW (lpString=".pdf") returned 4 [0269.715] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString=".xls") returned 4 [0269.715] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString=".xlsx") returned 5 [0269.715] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0269.715] lstrlenW (lpString=".ppt") returned 4 [0269.715] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.715] lstrlenW (lpString=".zip") returned 4 [0269.715] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.715] lstrlenW (lpString=".rar") returned 4 [0269.715] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString=".bz2") returned 4 [0269.715] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString=".7z") returned 3 [0269.715] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.715] lstrlenW (lpString=".dbf") returned 4 [0269.715] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.716] lstrlenW (lpString=".1cd") returned 4 [0269.716] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0269.716] lstrlenW (lpString=".jpg") returned 4 [0269.716] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.716] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.716] lstrlenW (lpString="SETUP.XML") returned 9 [0269.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0269.974] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2424) returned 1 [0269.974] CloseHandle (hObject=0x1f0) returned 1 [0269.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0269.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0269.974] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.974] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0270.383] GetLastError () returned 0x0 [0270.383] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x978, lpOverlapped=0x0) returned 1 [0270.397] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x980, lpOverlapped=0x0) returned 1 [0270.398] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.398] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0270.398] SetEndOfFile (hFile=0x1f4) returned 1 [0270.398] CloseHandle (hObject=0x1f4) returned 1 [0270.399] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.399] SetEndOfFile (hFile=0x1f0) returned 1 [0270.400] CloseHandle (hObject=0x1f0) returned 1 [0270.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0270.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.400] lstrlenW (lpString=".doc") returned 4 [0270.400] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.400] lstrlenW (lpString=".docx") returned 5 [0270.400] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0270.401] lstrlenW (lpString=".pdf") returned 4 [0270.401] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString=".xls") returned 4 [0270.401] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString=".xlsx") returned 5 [0270.401] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0270.401] lstrlenW (lpString=".ppt") returned 4 [0270.401] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.401] lstrlenW (lpString=".zip") returned 4 [0270.401] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.401] lstrlenW (lpString=".rar") returned 4 [0270.401] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString=".bz2") returned 4 [0270.401] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString=".7z") returned 3 [0270.401] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.401] lstrlenW (lpString=".dbf") returned 4 [0270.401] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.401] lstrlenW (lpString=".1cd") returned 4 [0270.401] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.401] lstrlenW (lpString=".jpg") returned 4 [0270.401] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.401] lstrlenW (lpString=".doc") returned 4 [0270.401] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.401] lstrlenW (lpString=".docx") returned 5 [0270.401] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0270.401] lstrlenW (lpString=".pdf") returned 4 [0270.401] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString=".xls") returned 4 [0270.402] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString=".xlsx") returned 5 [0270.402] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0270.402] lstrlenW (lpString=".ppt") returned 4 [0270.402] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.402] lstrlenW (lpString=".zip") returned 4 [0270.402] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.402] lstrlenW (lpString=".rar") returned 4 [0270.402] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString=".bz2") returned 4 [0270.402] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString=".7z") returned 3 [0270.402] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.402] lstrlenW (lpString=".dbf") returned 4 [0270.402] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.402] lstrlenW (lpString=".1cd") returned 4 [0270.402] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0270.402] lstrlenW (lpString=".jpg") returned 4 [0270.402] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.402] lstrcmpiW (lpString1=".gif", lpString2=".drweb") returned 1 [0270.402] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0270.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.403] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4587) returned 1 [0270.403] CloseHandle (hObject=0x1f0) returned 1 [0270.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0270.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.404] lstrlenW (lpString=".doc") returned 4 [0270.404] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0270.404] lstrlenW (lpString=".docx") returned 5 [0270.404] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0270.404] lstrlenW (lpString=".pdf") returned 4 [0270.404] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0270.404] lstrlenW (lpString=".xls") returned 4 [0270.404] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0270.404] lstrlenW (lpString=".xlsx") returned 5 [0270.404] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0270.404] lstrlenW (lpString=".ppt") returned 4 [0270.404] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0270.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.404] lstrlenW (lpString=".zip") returned 4 [0270.404] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0270.404] lstrlenW (lpString=".rar") returned 4 [0270.404] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0270.404] lstrlenW (lpString=".bz2") returned 4 [0270.404] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0270.404] lstrlenW (lpString=".7z") returned 3 [0270.404] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0270.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.404] lstrlenW (lpString=".dbf") returned 4 [0270.404] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0270.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.404] lstrlenW (lpString=".1cd") returned 4 [0270.404] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString=".jpg") returned 4 [0270.405] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString=".doc") returned 4 [0270.405] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0270.405] lstrlenW (lpString=".docx") returned 5 [0270.405] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0270.405] lstrlenW (lpString=".pdf") returned 4 [0270.405] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0270.405] lstrlenW (lpString=".xls") returned 4 [0270.405] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0270.405] lstrlenW (lpString=".xlsx") returned 5 [0270.405] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0270.405] lstrlenW (lpString=".ppt") returned 4 [0270.405] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString=".zip") returned 4 [0270.405] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0270.405] lstrlenW (lpString=".rar") returned 4 [0270.405] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0270.405] lstrlenW (lpString=".bz2") returned 4 [0270.405] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0270.405] lstrlenW (lpString=".7z") returned 3 [0270.405] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString=".dbf") returned 4 [0270.405] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString=".1cd") returned 4 [0270.405] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0270.405] lstrlenW (lpString=".jpg") returned 4 [0270.405] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0270.406] lstrcmpiW (lpString1=".gif", lpString2=".drweb") returned 1 [0270.406] lstrlenW (lpString="Connectivity.gif") returned 16 [0270.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.406] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2319) returned 1 [0270.406] CloseHandle (hObject=0x1f0) returned 1 [0270.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0270.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.406] lstrlenW (lpString=".doc") returned 4 [0270.406] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0270.406] lstrlenW (lpString=".docx") returned 5 [0270.406] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0270.406] lstrlenW (lpString=".pdf") returned 4 [0270.406] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0270.406] lstrlenW (lpString=".xls") returned 4 [0270.407] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0270.407] lstrlenW (lpString=".xlsx") returned 5 [0270.407] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0270.407] lstrlenW (lpString=".ppt") returned 4 [0270.407] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0270.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.407] lstrlenW (lpString=".zip") returned 4 [0270.407] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0270.407] lstrlenW (lpString=".rar") returned 4 [0270.407] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0270.407] lstrlenW (lpString=".bz2") returned 4 [0270.407] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0270.407] lstrlenW (lpString=".7z") returned 3 [0270.407] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0270.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.407] lstrlenW (lpString=".dbf") returned 4 [0270.407] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0270.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.407] lstrlenW (lpString=".1cd") returned 4 [0270.407] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0270.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.407] lstrlenW (lpString=".jpg") returned 4 [0270.407] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0270.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.407] lstrlenW (lpString=".doc") returned 4 [0270.407] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0270.407] lstrlenW (lpString=".docx") returned 5 [0270.407] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0270.408] lstrlenW (lpString=".pdf") returned 4 [0270.408] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0270.408] lstrlenW (lpString=".xls") returned 4 [0270.408] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0270.408] lstrlenW (lpString=".xlsx") returned 5 [0270.408] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0270.408] lstrlenW (lpString=".ppt") returned 4 [0270.408] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0270.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.408] lstrlenW (lpString=".zip") returned 4 [0270.408] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0270.408] lstrlenW (lpString=".rar") returned 4 [0270.408] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0270.408] lstrlenW (lpString=".bz2") returned 4 [0270.408] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0270.408] lstrlenW (lpString=".7z") returned 3 [0270.408] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0270.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.408] lstrlenW (lpString=".dbf") returned 4 [0270.408] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0270.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.408] lstrlenW (lpString=".1cd") returned 4 [0270.408] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0270.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0270.408] lstrlenW (lpString=".jpg") returned 4 [0270.408] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0270.409] lstrcmpiW (lpString1=".ini", lpString2=".drweb") returned 1 [0270.409] lstrlenW (lpString="Desktop.ini") returned 11 [0270.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.409] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=645) returned 1 [0270.409] CloseHandle (hObject=0x1f0) returned 1 [0270.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0270.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.410] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0270.410] GetLastError () returned 0x0 [0270.410] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x285, lpOverlapped=0x0) returned 1 [0270.411] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0270.412] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.412] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.412] SetEndOfFile (hFile=0x1f4) returned 1 [0270.413] CloseHandle (hObject=0x1f4) returned 1 [0270.415] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.415] SetEndOfFile (hFile=0x1f0) returned 1 [0270.416] CloseHandle (hObject=0x1f0) returned 1 [0270.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x26) returned 1 [0270.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0270.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.416] lstrlenW (lpString=".doc") returned 4 [0270.416] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0270.416] lstrlenW (lpString=".docx") returned 5 [0270.416] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0270.416] lstrlenW (lpString=".pdf") returned 4 [0270.416] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0270.416] lstrlenW (lpString=".xls") returned 4 [0270.416] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0270.416] lstrlenW (lpString=".xlsx") returned 5 [0270.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0270.416] lstrlenW (lpString=".ppt") returned 4 [0270.417] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString=".zip") returned 4 [0270.417] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString=".rar") returned 4 [0270.417] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString=".bz2") returned 4 [0270.417] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0270.417] lstrlenW (lpString=".7z") returned 3 [0270.417] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString=".dbf") returned 4 [0270.417] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString=".1cd") returned 4 [0270.417] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString=".jpg") returned 4 [0270.417] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString=".doc") returned 4 [0270.417] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0270.417] lstrlenW (lpString=".docx") returned 5 [0270.417] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0270.417] lstrlenW (lpString=".pdf") returned 4 [0270.417] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString=".xls") returned 4 [0270.417] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString=".xlsx") returned 5 [0270.417] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0270.417] lstrlenW (lpString=".ppt") returned 4 [0270.417] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0270.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.417] lstrlenW (lpString=".zip") returned 4 [0270.418] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0270.418] lstrlenW (lpString=".rar") returned 4 [0270.418] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0270.418] lstrlenW (lpString=".bz2") returned 4 [0270.418] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0270.418] lstrlenW (lpString=".7z") returned 3 [0270.418] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0270.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.418] lstrlenW (lpString=".dbf") returned 4 [0270.418] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0270.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.418] lstrlenW (lpString=".1cd") returned 4 [0270.418] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0270.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0270.418] lstrlenW (lpString=".jpg") returned 4 [0270.418] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0270.418] lstrcmpiW (lpString1=".emf", lpString2=".drweb") returned 1 [0270.418] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0270.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.418] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3792) returned 1 [0270.419] CloseHandle (hObject=0x1f0) returned 1 [0270.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0270.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.419] lstrlenW (lpString=".doc") returned 4 [0270.419] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0270.419] lstrlenW (lpString=".docx") returned 5 [0270.419] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0270.419] lstrlenW (lpString=".pdf") returned 4 [0270.419] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0270.419] lstrlenW (lpString=".xls") returned 4 [0270.419] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0270.419] lstrlenW (lpString=".xlsx") returned 5 [0270.419] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0270.419] lstrlenW (lpString=".ppt") returned 4 [0270.419] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0270.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.419] lstrlenW (lpString=".zip") returned 4 [0270.419] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0270.419] lstrlenW (lpString=".rar") returned 4 [0270.419] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0270.419] lstrlenW (lpString=".bz2") returned 4 [0270.419] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0270.419] lstrlenW (lpString=".7z") returned 3 [0270.419] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0270.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.420] lstrlenW (lpString=".dbf") returned 4 [0270.420] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0270.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.420] lstrlenW (lpString=".1cd") returned 4 [0270.420] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0270.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.420] lstrlenW (lpString=".jpg") returned 4 [0270.420] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0270.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.420] lstrlenW (lpString=".doc") returned 4 [0270.420] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0270.420] lstrlenW (lpString=".docx") returned 5 [0270.420] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0270.420] lstrlenW (lpString=".pdf") returned 4 [0270.420] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0270.420] lstrlenW (lpString=".xls") returned 4 [0270.420] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0270.420] lstrlenW (lpString=".xlsx") returned 5 [0270.420] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0270.420] lstrlenW (lpString=".ppt") returned 4 [0270.420] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0270.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.420] lstrlenW (lpString=".zip") returned 4 [0270.420] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0270.420] lstrlenW (lpString=".rar") returned 4 [0270.420] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0270.420] lstrlenW (lpString=".bz2") returned 4 [0270.420] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0270.420] lstrlenW (lpString=".7z") returned 3 [0270.421] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0270.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.421] lstrlenW (lpString=".dbf") returned 4 [0270.421] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0270.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.421] lstrlenW (lpString=".1cd") returned 4 [0270.421] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0270.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0270.421] lstrlenW (lpString=".jpg") returned 4 [0270.421] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0270.421] lstrcmpiW (lpString1=".htm", lpString2=".drweb") returned 1 [0270.421] lstrlenW (lpString="Garden.htm") returned 10 [0270.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.421] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=231) returned 1 [0270.421] CloseHandle (hObject=0x1f0) returned 1 [0270.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0270.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.422] lstrlenW (lpString=".doc") returned 4 [0270.422] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.422] lstrlenW (lpString=".docx") returned 5 [0270.422] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0270.422] lstrlenW (lpString=".pdf") returned 4 [0270.422] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.422] lstrlenW (lpString=".xls") returned 4 [0270.422] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.422] lstrlenW (lpString=".xlsx") returned 5 [0270.422] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0270.422] lstrlenW (lpString=".ppt") returned 4 [0270.422] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.422] lstrlenW (lpString=".zip") returned 4 [0270.422] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.422] lstrlenW (lpString=".rar") returned 4 [0270.422] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.422] lstrlenW (lpString=".bz2") returned 4 [0270.422] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.422] lstrlenW (lpString=".7z") returned 3 [0270.422] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.422] lstrlenW (lpString=".dbf") returned 4 [0270.422] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.422] lstrlenW (lpString=".1cd") returned 4 [0270.422] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.422] lstrlenW (lpString=".jpg") returned 4 [0270.422] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.423] lstrlenW (lpString=".doc") returned 4 [0270.423] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.423] lstrlenW (lpString=".docx") returned 5 [0270.423] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0270.423] lstrlenW (lpString=".pdf") returned 4 [0270.423] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.423] lstrlenW (lpString=".xls") returned 4 [0270.423] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.423] lstrlenW (lpString=".xlsx") returned 5 [0270.423] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0270.423] lstrlenW (lpString=".ppt") returned 4 [0270.423] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.423] lstrlenW (lpString=".zip") returned 4 [0270.423] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.423] lstrlenW (lpString=".rar") returned 4 [0270.423] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.423] lstrlenW (lpString=".bz2") returned 4 [0270.423] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.423] lstrlenW (lpString=".7z") returned 3 [0270.423] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.423] lstrlenW (lpString=".dbf") returned 4 [0270.423] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.423] lstrlenW (lpString=".1cd") returned 4 [0270.423] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0270.423] lstrlenW (lpString=".jpg") returned 4 [0270.423] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.424] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.424] lstrlenW (lpString="Garden.jpg") returned 10 [0270.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0270.424] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=23871) returned 1 [0270.424] CloseHandle (hObject=0x1f0) returned 1 [0270.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0270.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.424] lstrlenW (lpString=".doc") returned 4 [0270.424] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.424] lstrlenW (lpString=".docx") returned 5 [0270.424] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0270.424] lstrlenW (lpString=".pdf") returned 4 [0270.424] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.424] lstrlenW (lpString=".xls") returned 4 [0270.424] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.425] lstrlenW (lpString=".xlsx") returned 5 [0270.425] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0270.425] lstrlenW (lpString=".ppt") returned 4 [0270.425] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.425] lstrlenW (lpString=".zip") returned 4 [0270.425] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.425] lstrlenW (lpString=".rar") returned 4 [0270.425] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.425] lstrlenW (lpString=".bz2") returned 4 [0270.425] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.425] lstrlenW (lpString=".7z") returned 3 [0270.425] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.425] lstrlenW (lpString=".dbf") returned 4 [0270.425] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.425] lstrlenW (lpString=".1cd") returned 4 [0270.425] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.425] lstrlenW (lpString=".jpg") returned 4 [0270.425] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.425] lstrlenW (lpString=".doc") returned 4 [0270.425] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.425] lstrlenW (lpString=".docx") returned 5 [0270.425] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0270.425] lstrlenW (lpString=".pdf") returned 4 [0270.425] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.425] lstrlenW (lpString=".xls") returned 4 [0270.425] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.425] lstrlenW (lpString=".xlsx") returned 5 [0270.425] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0270.426] lstrlenW (lpString=".ppt") returned 4 [0270.426] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.426] lstrlenW (lpString=".zip") returned 4 [0270.426] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.426] lstrlenW (lpString=".rar") returned 4 [0270.426] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.426] lstrlenW (lpString=".bz2") returned 4 [0270.426] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.426] lstrlenW (lpString=".7z") returned 3 [0270.426] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.426] lstrlenW (lpString=".dbf") returned 4 [0270.426] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.426] lstrlenW (lpString=".1cd") returned 4 [0270.426] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0270.426] lstrlenW (lpString=".jpg") returned 4 [0270.426] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.426] lstrcmpiW (lpString1=".emf", lpString2=".drweb") returned 1 [0270.426] lstrlenW (lpString="Genko_1.emf") returned 11 [0270.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0271.264] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=5524) returned 1 [0271.264] CloseHandle (hObject=0x18c) returned 1 [0271.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0271.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0271.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.265] lstrlenW (lpString=".doc") returned 4 [0271.265] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0271.265] lstrlenW (lpString=".docx") returned 5 [0271.265] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0271.265] lstrlenW (lpString=".pdf") returned 4 [0271.265] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0271.265] lstrlenW (lpString=".xls") returned 4 [0271.265] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0271.265] lstrlenW (lpString=".xlsx") returned 5 [0271.265] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0271.265] lstrlenW (lpString=".ppt") returned 4 [0271.265] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0271.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.265] lstrlenW (lpString=".zip") returned 4 [0271.265] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0271.265] lstrlenW (lpString=".rar") returned 4 [0271.265] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0271.265] lstrlenW (lpString=".bz2") returned 4 [0271.265] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0271.265] lstrlenW (lpString=".7z") returned 3 [0271.265] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0271.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.265] lstrlenW (lpString=".dbf") returned 4 [0271.265] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0271.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.265] lstrlenW (lpString=".1cd") returned 4 [0271.265] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0271.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.266] lstrlenW (lpString=".jpg") returned 4 [0271.266] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0271.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.266] lstrlenW (lpString=".doc") returned 4 [0271.266] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0271.266] lstrlenW (lpString=".docx") returned 5 [0271.266] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0271.266] lstrlenW (lpString=".pdf") returned 4 [0271.266] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0271.266] lstrlenW (lpString=".xls") returned 4 [0271.266] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0271.266] lstrlenW (lpString=".xlsx") returned 5 [0271.266] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0271.266] lstrlenW (lpString=".ppt") returned 4 [0271.266] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0271.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.266] lstrlenW (lpString=".zip") returned 4 [0271.266] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0271.266] lstrlenW (lpString=".rar") returned 4 [0271.266] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0271.267] lstrlenW (lpString=".bz2") returned 4 [0271.267] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0271.267] lstrlenW (lpString=".7z") returned 3 [0271.267] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0271.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.267] lstrlenW (lpString=".dbf") returned 4 [0271.267] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0271.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.267] lstrlenW (lpString=".1cd") returned 4 [0271.267] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0271.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0271.267] lstrlenW (lpString=".jpg") returned 4 [0271.267] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0271.267] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0271.267] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0271.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0271.387] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2985) returned 1 [0271.387] CloseHandle (hObject=0x18c) returned 1 [0271.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0271.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0271.388] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.388] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0271.726] GetLastError () returned 0x0 [0271.726] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xba9, lpOverlapped=0x0) returned 1 [0271.801] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0271.802] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.802] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.802] SetEndOfFile (hFile=0x1e4) returned 1 [0271.802] CloseHandle (hObject=0x1e4) returned 1 [0271.802] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.802] SetEndOfFile (hFile=0x18c) returned 1 [0271.803] CloseHandle (hObject=0x18c) returned 1 [0271.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.803] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0271.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.804] lstrlenW (lpString=".doc") returned 4 [0271.804] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.804] lstrlenW (lpString=".docx") returned 5 [0271.804] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.804] lstrlenW (lpString=".pdf") returned 4 [0271.804] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.804] lstrlenW (lpString=".xls") returned 4 [0271.804] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.804] lstrlenW (lpString=".xlsx") returned 5 [0271.804] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.804] lstrlenW (lpString=".ppt") returned 4 [0271.804] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.804] lstrlenW (lpString=".zip") returned 4 [0271.804] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.804] lstrlenW (lpString=".rar") returned 4 [0271.804] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.804] lstrlenW (lpString=".bz2") returned 4 [0271.804] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.804] lstrlenW (lpString=".7z") returned 3 [0271.804] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.804] lstrlenW (lpString=".dbf") returned 4 [0271.805] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.805] lstrlenW (lpString=".1cd") returned 4 [0271.805] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.805] lstrlenW (lpString=".jpg") returned 4 [0271.805] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.805] lstrlenW (lpString=".doc") returned 4 [0271.805] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.805] lstrlenW (lpString=".docx") returned 5 [0271.805] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.805] lstrlenW (lpString=".pdf") returned 4 [0271.805] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.805] lstrlenW (lpString=".xls") returned 4 [0271.805] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.805] lstrlenW (lpString=".xlsx") returned 5 [0271.805] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.805] lstrlenW (lpString=".ppt") returned 4 [0271.805] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.805] lstrlenW (lpString=".zip") returned 4 [0271.805] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.805] lstrlenW (lpString=".rar") returned 4 [0271.805] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.805] lstrlenW (lpString=".bz2") returned 4 [0271.806] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.806] lstrlenW (lpString=".7z") returned 3 [0271.806] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.806] lstrlenW (lpString=".dbf") returned 4 [0271.806] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.806] lstrlenW (lpString=".1cd") returned 4 [0271.806] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0271.806] lstrlenW (lpString=".jpg") returned 4 [0271.806] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.806] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0271.806] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0271.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0272.847] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=33009) returned 1 [0272.847] CloseHandle (hObject=0x1f0) returned 1 [0272.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0272.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0272.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0272.848] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.848] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0272.848] GetLastError () returned 0x0 [0272.848] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0273.304] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0273.305] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.305] WriteFile (in: hFile=0x164, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.306] SetEndOfFile (hFile=0x164) returned 1 [0273.306] CloseHandle (hObject=0x164) returned 1 [0273.306] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.306] SetEndOfFile (hFile=0x1f0) returned 1 [0273.307] CloseHandle (hObject=0x1f0) returned 1 [0273.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.307] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0273.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.308] lstrlenW (lpString=".doc") returned 4 [0273.308] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.308] lstrlenW (lpString=".docx") returned 5 [0273.308] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.308] lstrlenW (lpString=".pdf") returned 4 [0273.308] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.308] lstrlenW (lpString=".xls") returned 4 [0273.308] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.308] lstrlenW (lpString=".xlsx") returned 5 [0273.308] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.308] lstrlenW (lpString=".ppt") returned 4 [0273.308] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.308] lstrlenW (lpString=".zip") returned 4 [0273.308] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.308] lstrlenW (lpString=".rar") returned 4 [0273.308] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.308] lstrlenW (lpString=".bz2") returned 4 [0273.308] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.308] lstrlenW (lpString=".7z") returned 3 [0273.309] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.309] lstrlenW (lpString=".dbf") returned 4 [0273.309] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.309] lstrlenW (lpString=".1cd") returned 4 [0273.309] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.309] lstrlenW (lpString=".jpg") returned 4 [0273.309] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.309] lstrlenW (lpString=".doc") returned 4 [0273.309] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.309] lstrlenW (lpString=".docx") returned 5 [0273.309] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.309] lstrlenW (lpString=".pdf") returned 4 [0273.309] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.309] lstrlenW (lpString=".xls") returned 4 [0273.309] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.309] lstrlenW (lpString=".xlsx") returned 5 [0273.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.309] lstrlenW (lpString=".ppt") returned 4 [0273.309] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.309] lstrlenW (lpString=".zip") returned 4 [0273.310] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.310] lstrlenW (lpString=".rar") returned 4 [0273.310] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.310] lstrlenW (lpString=".bz2") returned 4 [0273.310] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.310] lstrlenW (lpString=".7z") returned 3 [0273.310] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.310] lstrlenW (lpString=".dbf") returned 4 [0273.310] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.310] lstrlenW (lpString=".1cd") returned 4 [0273.310] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0273.310] lstrlenW (lpString=".jpg") returned 4 [0273.310] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.310] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0273.310] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0273.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0273.747] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=32607) returned 1 [0273.747] CloseHandle (hObject=0x1b0) returned 1 [0273.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0273.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0273.748] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.748] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0273.748] GetLastError () returned 0x0 [0273.748] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0273.862] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0273.864] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.864] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.864] SetEndOfFile (hFile=0x18c) returned 1 [0273.864] CloseHandle (hObject=0x18c) returned 1 [0273.864] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.865] SetEndOfFile (hFile=0x1b0) returned 1 [0273.866] CloseHandle (hObject=0x1b0) returned 1 [0273.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0273.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.866] lstrlenW (lpString=".doc") returned 4 [0273.866] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.866] lstrlenW (lpString=".docx") returned 5 [0273.866] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.866] lstrlenW (lpString=".pdf") returned 4 [0273.866] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.866] lstrlenW (lpString=".xls") returned 4 [0273.866] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.867] lstrlenW (lpString=".xlsx") returned 5 [0273.867] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.867] lstrlenW (lpString=".ppt") returned 4 [0273.867] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.867] lstrlenW (lpString=".zip") returned 4 [0273.867] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.867] lstrlenW (lpString=".rar") returned 4 [0273.867] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.867] lstrlenW (lpString=".bz2") returned 4 [0273.867] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.867] lstrlenW (lpString=".7z") returned 3 [0273.867] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.867] lstrlenW (lpString=".dbf") returned 4 [0273.867] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.867] lstrlenW (lpString=".1cd") returned 4 [0273.867] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.867] lstrlenW (lpString=".jpg") returned 4 [0273.867] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.867] lstrlenW (lpString=".doc") returned 4 [0273.867] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.867] lstrlenW (lpString=".docx") returned 5 [0273.867] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.868] lstrlenW (lpString=".pdf") returned 4 [0273.868] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.868] lstrlenW (lpString=".xls") returned 4 [0273.868] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.868] lstrlenW (lpString=".xlsx") returned 5 [0273.868] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.868] lstrlenW (lpString=".ppt") returned 4 [0273.868] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.868] lstrlenW (lpString=".zip") returned 4 [0273.868] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.868] lstrlenW (lpString=".rar") returned 4 [0273.868] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.868] lstrlenW (lpString=".bz2") returned 4 [0273.868] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.868] lstrlenW (lpString=".7z") returned 3 [0273.868] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.868] lstrlenW (lpString=".dbf") returned 4 [0273.868] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.868] lstrlenW (lpString=".1cd") returned 4 [0273.868] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0273.868] lstrlenW (lpString=".jpg") returned 4 [0273.868] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.869] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0273.869] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0273.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0273.869] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=29925) returned 1 [0273.869] CloseHandle (hObject=0x1b0) returned 1 [0273.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0273.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0273.869] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0273.870] GetLastError () returned 0x0 [0273.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0273.872] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0273.874] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.874] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.874] SetEndOfFile (hFile=0x18c) returned 1 [0273.874] CloseHandle (hObject=0x18c) returned 1 [0273.874] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.875] SetEndOfFile (hFile=0x1b0) returned 1 [0273.876] CloseHandle (hObject=0x1b0) returned 1 [0273.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0273.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.876] lstrlenW (lpString=".doc") returned 4 [0273.876] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.876] lstrlenW (lpString=".docx") returned 5 [0273.876] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.876] lstrlenW (lpString=".pdf") returned 4 [0273.876] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.876] lstrlenW (lpString=".xls") returned 4 [0273.876] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.876] lstrlenW (lpString=".xlsx") returned 5 [0273.877] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.877] lstrlenW (lpString=".ppt") returned 4 [0273.877] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.877] lstrlenW (lpString=".zip") returned 4 [0273.877] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.877] lstrlenW (lpString=".rar") returned 4 [0273.877] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.877] lstrlenW (lpString=".bz2") returned 4 [0273.877] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.877] lstrlenW (lpString=".7z") returned 3 [0273.877] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.877] lstrlenW (lpString=".dbf") returned 4 [0273.877] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.877] lstrlenW (lpString=".1cd") returned 4 [0273.877] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.877] lstrlenW (lpString=".jpg") returned 4 [0273.877] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.878] lstrlenW (lpString=".doc") returned 4 [0273.878] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.878] lstrlenW (lpString=".docx") returned 5 [0273.878] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.878] lstrlenW (lpString=".pdf") returned 4 [0273.878] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.878] lstrlenW (lpString=".xls") returned 4 [0273.878] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.878] lstrlenW (lpString=".xlsx") returned 5 [0273.878] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.878] lstrlenW (lpString=".ppt") returned 4 [0273.878] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.878] lstrlenW (lpString=".zip") returned 4 [0273.878] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.878] lstrlenW (lpString=".rar") returned 4 [0273.878] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.878] lstrlenW (lpString=".bz2") returned 4 [0273.878] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.878] lstrlenW (lpString=".7z") returned 3 [0273.878] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.878] lstrlenW (lpString=".dbf") returned 4 [0273.878] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.878] lstrlenW (lpString=".1cd") returned 4 [0273.878] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0273.879] lstrlenW (lpString=".jpg") returned 4 [0273.879] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.879] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0273.879] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0273.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0273.879] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1363) returned 1 [0273.879] CloseHandle (hObject=0x1b0) returned 1 [0273.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0273.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0273.880] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.880] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0273.920] GetLastError () returned 0x0 [0273.920] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x553, lpOverlapped=0x0) returned 1 [0274.071] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x560, lpOverlapped=0x0) returned 1 [0274.073] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.073] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.073] SetEndOfFile (hFile=0x18c) returned 1 [0274.073] CloseHandle (hObject=0x18c) returned 1 [0274.073] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.073] SetEndOfFile (hFile=0x1b0) returned 1 [0274.074] CloseHandle (hObject=0x1b0) returned 1 [0274.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0274.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.075] lstrlenW (lpString=".doc") returned 4 [0274.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.075] lstrlenW (lpString=".docx") returned 5 [0274.075] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.075] lstrlenW (lpString=".pdf") returned 4 [0274.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.075] lstrlenW (lpString=".xls") returned 4 [0274.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.075] lstrlenW (lpString=".xlsx") returned 5 [0274.075] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.075] lstrlenW (lpString=".ppt") returned 4 [0274.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.075] lstrlenW (lpString=".zip") returned 4 [0274.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.075] lstrlenW (lpString=".rar") returned 4 [0274.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.075] lstrlenW (lpString=".bz2") returned 4 [0274.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.076] lstrlenW (lpString=".7z") returned 3 [0274.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.076] lstrlenW (lpString=".dbf") returned 4 [0274.076] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.076] lstrlenW (lpString=".1cd") returned 4 [0274.076] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.076] lstrlenW (lpString=".jpg") returned 4 [0274.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.076] lstrlenW (lpString=".doc") returned 4 [0274.076] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.076] lstrlenW (lpString=".docx") returned 5 [0274.076] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.076] lstrlenW (lpString=".pdf") returned 4 [0274.076] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.076] lstrlenW (lpString=".xls") returned 4 [0274.076] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.076] lstrlenW (lpString=".xlsx") returned 5 [0274.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.076] lstrlenW (lpString=".ppt") returned 4 [0274.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.077] lstrlenW (lpString=".zip") returned 4 [0274.077] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.077] lstrlenW (lpString=".rar") returned 4 [0274.077] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.077] lstrlenW (lpString=".bz2") returned 4 [0274.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.077] lstrlenW (lpString=".7z") returned 3 [0274.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.077] lstrlenW (lpString=".dbf") returned 4 [0274.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.077] lstrlenW (lpString=".1cd") returned 4 [0274.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0274.077] lstrlenW (lpString=".jpg") returned 4 [0274.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.077] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0274.077] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0274.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0274.078] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1293) returned 1 [0274.078] CloseHandle (hObject=0x1b0) returned 1 [0274.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0274.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0274.078] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.078] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0274.168] GetLastError () returned 0x0 [0274.168] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x50d, lpOverlapped=0x0) returned 1 [0274.327] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x510, lpOverlapped=0x0) returned 1 [0274.330] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.330] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.330] SetEndOfFile (hFile=0x18c) returned 1 [0274.330] CloseHandle (hObject=0x18c) returned 1 [0274.330] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.331] SetEndOfFile (hFile=0x1b0) returned 1 [0274.331] CloseHandle (hObject=0x1b0) returned 1 [0274.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.332] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.332] lstrlenW (lpString=".doc") returned 4 [0274.332] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.332] lstrlenW (lpString=".docx") returned 5 [0274.332] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.332] lstrlenW (lpString=".pdf") returned 4 [0274.332] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.332] lstrlenW (lpString=".xls") returned 4 [0274.332] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.332] lstrlenW (lpString=".xlsx") returned 5 [0274.332] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.332] lstrlenW (lpString=".ppt") returned 4 [0274.332] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.332] lstrlenW (lpString=".zip") returned 4 [0274.332] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.332] lstrlenW (lpString=".rar") returned 4 [0274.332] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.332] lstrlenW (lpString=".bz2") returned 4 [0274.332] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.332] lstrlenW (lpString=".7z") returned 3 [0274.332] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.332] lstrlenW (lpString=".dbf") returned 4 [0274.332] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.332] lstrlenW (lpString=".1cd") returned 4 [0274.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.333] lstrlenW (lpString=".jpg") returned 4 [0274.333] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.333] lstrlenW (lpString=".doc") returned 4 [0274.333] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.333] lstrlenW (lpString=".docx") returned 5 [0274.333] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.333] lstrlenW (lpString=".pdf") returned 4 [0274.333] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.333] lstrlenW (lpString=".xls") returned 4 [0274.333] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.333] lstrlenW (lpString=".xlsx") returned 5 [0274.333] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.333] lstrlenW (lpString=".ppt") returned 4 [0274.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.333] lstrlenW (lpString=".zip") returned 4 [0274.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.333] lstrlenW (lpString=".rar") returned 4 [0274.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.333] lstrlenW (lpString=".bz2") returned 4 [0274.333] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.333] lstrlenW (lpString=".7z") returned 3 [0274.333] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.333] lstrlenW (lpString=".dbf") returned 4 [0274.333] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.334] lstrlenW (lpString=".1cd") returned 4 [0274.334] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0274.334] lstrlenW (lpString=".jpg") returned 4 [0274.334] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.359] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.359] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0274.360] GetLastError () returned 0x0 [0274.360] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0274.463] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0274.465] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.465] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.465] SetEndOfFile (hFile=0x18c) returned 1 [0274.465] CloseHandle (hObject=0x18c) returned 1 [0274.465] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.465] SetEndOfFile (hFile=0x1b0) returned 1 [0274.466] CloseHandle (hObject=0x1b0) returned 1 [0274.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0274.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0274.467] lstrlenW (lpString=".doc") returned 4 [0274.467] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.467] lstrlenW (lpString=".docx") returned 5 [0274.467] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.467] lstrlenW (lpString=".pdf") returned 4 [0274.467] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.467] lstrlenW (lpString=".xls") returned 4 [0274.467] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.467] lstrlenW (lpString=".xlsx") returned 5 [0274.467] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.467] lstrlenW (lpString=".ppt") returned 4 [0274.467] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0274.467] lstrlenW (lpString=".zip") returned 4 [0274.467] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.467] lstrlenW (lpString=".rar") returned 4 [0274.467] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.467] lstrlenW (lpString=".bz2") returned 4 [0274.467] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.467] lstrlenW (lpString=".7z") returned 3 [0274.467] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0274.468] lstrlenW (lpString=".dbf") returned 4 [0274.468] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0274.468] lstrlenW (lpString=".1cd") returned 4 [0274.468] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0274.468] lstrlenW (lpString=".jpg") returned 4 [0274.468] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.468] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.468] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0274.586] GetLastError () returned 0x0 [0274.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0274.728] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0274.729] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.729] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.730] SetEndOfFile (hFile=0x18c) returned 1 [0274.730] CloseHandle (hObject=0x18c) returned 1 [0274.730] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.730] SetEndOfFile (hFile=0x1b0) returned 1 [0274.731] CloseHandle (hObject=0x1b0) returned 1 [0274.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0274.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0274.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0274.732] lstrlenW (lpString=".doc") returned 4 [0274.732] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.732] lstrlenW (lpString=".docx") returned 5 [0274.732] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.732] lstrlenW (lpString=".pdf") returned 4 [0274.732] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.732] lstrlenW (lpString=".xls") returned 4 [0274.732] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.732] lstrlenW (lpString=".xlsx") returned 5 [0274.732] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.732] lstrlenW (lpString=".ppt") returned 4 [0274.732] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0274.732] lstrlenW (lpString=".zip") returned 4 [0274.732] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.732] lstrlenW (lpString=".rar") returned 4 [0274.732] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.732] lstrlenW (lpString=".bz2") returned 4 [0274.732] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.733] lstrlenW (lpString=".7z") returned 3 [0274.733] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0274.733] lstrlenW (lpString=".dbf") returned 4 [0274.733] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0274.733] lstrlenW (lpString=".1cd") returned 4 [0274.733] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0274.733] lstrlenW (lpString=".jpg") returned 4 [0274.733] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.733] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.733] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0274.734] GetLastError () returned 0x0 [0274.734] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0274.760] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0274.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.761] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.762] SetEndOfFile (hFile=0x18c) returned 1 [0274.762] CloseHandle (hObject=0x18c) returned 1 [0274.762] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.762] SetEndOfFile (hFile=0x1b0) returned 1 [0274.763] CloseHandle (hObject=0x1b0) returned 1 [0274.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0274.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0274.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0274.764] lstrlenW (lpString=".doc") returned 4 [0274.764] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.764] lstrlenW (lpString=".docx") returned 5 [0274.764] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.764] lstrlenW (lpString=".pdf") returned 4 [0274.764] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.764] lstrlenW (lpString=".xls") returned 4 [0274.764] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.764] lstrlenW (lpString=".xlsx") returned 5 [0274.764] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.764] lstrlenW (lpString=".ppt") returned 4 [0274.764] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0274.764] lstrlenW (lpString=".zip") returned 4 [0274.764] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.764] lstrlenW (lpString=".rar") returned 4 [0274.764] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.764] lstrlenW (lpString=".bz2") returned 4 [0274.764] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.764] lstrlenW (lpString=".7z") returned 3 [0274.764] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0274.764] lstrlenW (lpString=".dbf") returned 4 [0274.764] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0274.764] lstrlenW (lpString=".1cd") returned 4 [0274.764] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0274.764] lstrlenW (lpString=".jpg") returned 4 [0274.764] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.139] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.139] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0275.140] GetLastError () returned 0x0 [0275.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x6722, lpOverlapped=0x0) returned 1 [0275.295] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0275.296] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.296] WriteFile (in: hFile=0x18c, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.296] SetEndOfFile (hFile=0x18c) returned 1 [0275.296] CloseHandle (hObject=0x18c) returned 1 [0275.297] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.297] SetEndOfFile (hFile=0x1b0) returned 1 [0275.297] CloseHandle (hObject=0x1b0) returned 1 [0275.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0275.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0275.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0275.322] lstrlenW (lpString=".doc") returned 4 [0275.323] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.323] lstrlenW (lpString=".docx") returned 5 [0275.323] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.323] lstrlenW (lpString=".pdf") returned 4 [0275.323] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.323] lstrlenW (lpString=".xls") returned 4 [0275.323] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.323] lstrlenW (lpString=".xlsx") returned 5 [0275.323] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.323] lstrlenW (lpString=".ppt") returned 4 [0275.323] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0275.323] lstrlenW (lpString=".zip") returned 4 [0275.323] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.323] lstrlenW (lpString=".rar") returned 4 [0275.323] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.323] lstrlenW (lpString=".bz2") returned 4 [0275.323] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.323] lstrlenW (lpString=".7z") returned 3 [0275.323] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0275.323] lstrlenW (lpString=".dbf") returned 4 [0275.323] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0275.323] lstrlenW (lpString=".1cd") returned 4 [0275.323] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0275.323] lstrlenW (lpString=".jpg") returned 4 [0275.323] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.324] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.324] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0275.580] GetLastError () returned 0x0 [0275.580] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x54a, lpOverlapped=0x0) returned 1 [0275.786] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0275.787] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.787] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0275.787] SetEndOfFile (hFile=0x180) returned 1 [0275.787] CloseHandle (hObject=0x180) returned 1 [0275.787] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.788] SetEndOfFile (hFile=0x18c) returned 1 [0275.788] CloseHandle (hObject=0x18c) returned 1 [0275.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0275.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0275.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0275.789] lstrlenW (lpString=".doc") returned 4 [0275.789] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.789] lstrlenW (lpString=".docx") returned 5 [0275.789] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.789] lstrlenW (lpString=".pdf") returned 4 [0275.789] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.789] lstrlenW (lpString=".xls") returned 4 [0275.789] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.789] lstrlenW (lpString=".xlsx") returned 5 [0275.789] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.790] lstrlenW (lpString=".ppt") returned 4 [0275.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0275.790] lstrlenW (lpString=".zip") returned 4 [0275.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.790] lstrlenW (lpString=".rar") returned 4 [0275.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.790] lstrlenW (lpString=".bz2") returned 4 [0275.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.790] lstrlenW (lpString=".7z") returned 3 [0275.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0275.790] lstrlenW (lpString=".dbf") returned 4 [0275.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0275.790] lstrlenW (lpString=".1cd") returned 4 [0275.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0275.790] lstrlenW (lpString=".jpg") returned 4 [0275.790] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0276.049] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=33559) returned 1 [0276.049] CloseHandle (hObject=0x18c) returned 1 [0276.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0276.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0276.049] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.049] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0276.050] GetLastError () returned 0x0 [0276.050] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x8317, lpOverlapped=0x0) returned 1 [0277.738] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0278.021] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.021] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.024] SetEndOfFile (hFile=0x180) returned 1 [0278.024] CloseHandle (hObject=0x180) returned 1 [0278.024] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.024] SetEndOfFile (hFile=0x18c) returned 1 [0278.025] CloseHandle (hObject=0x18c) returned 1 [0278.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.025] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0278.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0278.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0278.026] lstrlenW (lpString=".doc") returned 4 [0278.026] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.026] lstrlenW (lpString=".docx") returned 5 [0278.026] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.026] lstrlenW (lpString=".pdf") returned 4 [0278.026] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.026] lstrlenW (lpString=".xls") returned 4 [0278.026] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.026] lstrlenW (lpString=".xlsx") returned 5 [0278.026] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.026] lstrlenW (lpString=".ppt") returned 4 [0278.026] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0278.026] lstrlenW (lpString=".zip") returned 4 [0278.026] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.026] lstrlenW (lpString=".rar") returned 4 [0278.026] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.026] lstrlenW (lpString=".bz2") returned 4 [0278.026] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.026] lstrlenW (lpString=".7z") returned 3 [0278.026] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0278.026] lstrlenW (lpString=".dbf") returned 4 [0278.026] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0278.026] lstrlenW (lpString=".1cd") returned 4 [0278.026] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0278.026] lstrlenW (lpString=".jpg") returned 4 [0278.026] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.027] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.027] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0278.027] GetLastError () returned 0x0 [0278.027] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0278.168] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0278.169] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.169] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.169] SetEndOfFile (hFile=0x180) returned 1 [0278.170] CloseHandle (hObject=0x180) returned 1 [0278.170] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.170] SetEndOfFile (hFile=0x18c) returned 1 [0278.171] CloseHandle (hObject=0x18c) returned 1 [0278.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0278.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0278.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0278.172] lstrlenW (lpString=".doc") returned 4 [0278.172] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.172] lstrlenW (lpString=".docx") returned 5 [0278.172] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.172] lstrlenW (lpString=".pdf") returned 4 [0278.172] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.172] lstrlenW (lpString=".xls") returned 4 [0278.172] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.172] lstrlenW (lpString=".xlsx") returned 5 [0278.172] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.173] lstrlenW (lpString=".ppt") returned 4 [0278.173] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0278.173] lstrlenW (lpString=".zip") returned 4 [0278.173] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.173] lstrlenW (lpString=".rar") returned 4 [0278.173] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.173] lstrlenW (lpString=".bz2") returned 4 [0278.173] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.173] lstrlenW (lpString=".7z") returned 3 [0278.173] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0278.173] lstrlenW (lpString=".dbf") returned 4 [0278.173] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0278.173] lstrlenW (lpString=".1cd") returned 4 [0278.173] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0278.173] lstrlenW (lpString=".jpg") returned 4 [0278.173] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.174] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.174] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0278.871] GetLastError () returned 0x0 [0278.871] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x563, lpOverlapped=0x0) returned 1 [0278.948] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0278.950] ReadFile (in: hFile=0x18c, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.950] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.950] SetEndOfFile (hFile=0x1e4) returned 1 [0278.951] CloseHandle (hObject=0x1e4) returned 1 [0278.951] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.951] SetEndOfFile (hFile=0x18c) returned 1 [0278.953] CloseHandle (hObject=0x18c) returned 1 [0278.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.954] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0278.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0278.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0278.955] lstrlenW (lpString=".doc") returned 4 [0278.955] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.955] lstrlenW (lpString=".docx") returned 5 [0278.955] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.955] lstrlenW (lpString=".pdf") returned 4 [0278.955] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.955] lstrlenW (lpString=".xls") returned 4 [0278.955] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.955] lstrlenW (lpString=".xlsx") returned 5 [0278.955] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.955] lstrlenW (lpString=".ppt") returned 4 [0278.955] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0278.955] lstrlenW (lpString=".zip") returned 4 [0278.955] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.955] lstrlenW (lpString=".rar") returned 4 [0278.955] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.956] lstrlenW (lpString=".bz2") returned 4 [0278.956] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.956] lstrlenW (lpString=".7z") returned 3 [0278.956] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0278.956] lstrlenW (lpString=".dbf") returned 4 [0278.956] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0278.956] lstrlenW (lpString=".1cd") returned 4 [0278.956] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0278.956] lstrlenW (lpString=".jpg") returned 4 [0278.956] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.153] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.153] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0279.153] GetLastError () returned 0x0 [0279.153] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x4162, lpOverlapped=0x0) returned 1 [0279.158] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0279.159] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.160] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.160] SetEndOfFile (hFile=0x1f4) returned 1 [0279.160] CloseHandle (hObject=0x1f4) returned 1 [0279.160] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.160] SetEndOfFile (hFile=0x1c4) returned 1 [0279.161] CloseHandle (hObject=0x1c4) returned 1 [0279.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0279.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0279.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0279.162] lstrlenW (lpString=".doc") returned 4 [0279.162] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.162] lstrlenW (lpString=".docx") returned 5 [0279.162] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.162] lstrlenW (lpString=".pdf") returned 4 [0279.162] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.162] lstrlenW (lpString=".xls") returned 4 [0279.162] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.162] lstrlenW (lpString=".xlsx") returned 5 [0279.162] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.162] lstrlenW (lpString=".ppt") returned 4 [0279.162] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0279.162] lstrlenW (lpString=".zip") returned 4 [0279.162] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.162] lstrlenW (lpString=".rar") returned 4 [0279.162] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.162] lstrlenW (lpString=".bz2") returned 4 [0279.162] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.162] lstrlenW (lpString=".7z") returned 3 [0279.162] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0279.162] lstrlenW (lpString=".dbf") returned 4 [0279.162] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0279.162] lstrlenW (lpString=".1cd") returned 4 [0279.162] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0279.162] lstrlenW (lpString=".jpg") returned 4 [0279.162] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.172] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.172] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0279.173] GetLastError () returned 0x0 [0279.173] ReadFile (in: hFile=0x1f4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0279.180] WriteFile (in: hFile=0x200, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0279.187] ReadFile (in: hFile=0x1f4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.187] WriteFile (in: hFile=0x200, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.187] SetEndOfFile (hFile=0x200) returned 1 [0279.187] CloseHandle (hObject=0x200) returned 1 [0279.187] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.187] SetEndOfFile (hFile=0x1f4) returned 1 [0279.190] CloseHandle (hObject=0x1f4) returned 1 [0279.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0279.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0279.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0279.191] lstrlenW (lpString=".doc") returned 4 [0279.191] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.191] lstrlenW (lpString=".docx") returned 5 [0279.191] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.191] lstrlenW (lpString=".pdf") returned 4 [0279.191] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.191] lstrlenW (lpString=".xls") returned 4 [0279.191] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.191] lstrlenW (lpString=".xlsx") returned 5 [0279.191] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.191] lstrlenW (lpString=".ppt") returned 4 [0279.191] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0279.191] lstrlenW (lpString=".zip") returned 4 [0279.191] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.191] lstrlenW (lpString=".rar") returned 4 [0279.191] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.191] lstrlenW (lpString=".bz2") returned 4 [0279.191] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.191] lstrlenW (lpString=".7z") returned 3 [0279.191] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0279.191] lstrlenW (lpString=".dbf") returned 4 [0279.191] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0279.191] lstrlenW (lpString=".1cd") returned 4 [0279.191] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0279.192] lstrlenW (lpString=".jpg") returned 4 [0279.192] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.235] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1666) returned 1 [0279.235] CloseHandle (hObject=0x1e0) returned 1 [0279.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0279.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0279.236] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.236] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0279.237] GetLastError () returned 0x0 [0279.237] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x682, lpOverlapped=0x0) returned 1 [0279.246] WriteFile (in: hFile=0x1c4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x690, lpOverlapped=0x0) returned 1 [0279.247] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.247] WriteFile (in: hFile=0x1c4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.247] SetEndOfFile (hFile=0x1c4) returned 1 [0279.247] CloseHandle (hObject=0x1c4) returned 1 [0279.247] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.247] SetEndOfFile (hFile=0x1e0) returned 1 [0279.248] CloseHandle (hObject=0x1e0) returned 1 [0279.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.249] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0279.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0279.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0279.249] lstrlenW (lpString=".doc") returned 4 [0279.249] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.249] lstrlenW (lpString=".docx") returned 5 [0279.249] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.249] lstrlenW (lpString=".pdf") returned 4 [0279.249] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.249] lstrlenW (lpString=".xls") returned 4 [0279.249] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.249] lstrlenW (lpString=".xlsx") returned 5 [0279.249] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.249] lstrlenW (lpString=".ppt") returned 4 [0279.249] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0279.249] lstrlenW (lpString=".zip") returned 4 [0279.249] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.249] lstrlenW (lpString=".rar") returned 4 [0279.249] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.249] lstrlenW (lpString=".bz2") returned 4 [0279.249] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.250] lstrlenW (lpString=".7z") returned 3 [0279.250] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0279.250] lstrlenW (lpString=".dbf") returned 4 [0279.250] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0279.250] lstrlenW (lpString=".1cd") returned 4 [0279.250] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0279.250] lstrlenW (lpString=".jpg") returned 4 [0279.250] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.250] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.250] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.322] GetLastError () returned 0x0 [0279.322] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x58f, lpOverlapped=0x0) returned 1 [0279.338] WriteFile (in: hFile=0x214, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x590, lpOverlapped=0x0) returned 1 [0279.339] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.339] WriteFile (in: hFile=0x214, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.339] SetEndOfFile (hFile=0x214) returned 1 [0279.339] CloseHandle (hObject=0x214) returned 1 [0279.339] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.339] SetEndOfFile (hFile=0x1e0) returned 1 [0279.340] CloseHandle (hObject=0x1e0) returned 1 [0279.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0279.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0279.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0279.341] lstrlenW (lpString=".doc") returned 4 [0279.341] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.341] lstrlenW (lpString=".docx") returned 5 [0279.341] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.341] lstrlenW (lpString=".pdf") returned 4 [0279.341] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.341] lstrlenW (lpString=".xls") returned 4 [0279.341] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.341] lstrlenW (lpString=".xlsx") returned 5 [0279.341] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.341] lstrlenW (lpString=".ppt") returned 4 [0279.341] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0279.341] lstrlenW (lpString=".zip") returned 4 [0279.341] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.341] lstrlenW (lpString=".rar") returned 4 [0279.341] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.342] lstrlenW (lpString=".bz2") returned 4 [0279.342] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.342] lstrlenW (lpString=".7z") returned 3 [0279.342] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0279.342] lstrlenW (lpString=".dbf") returned 4 [0279.342] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0279.342] lstrlenW (lpString=".1cd") returned 4 [0279.342] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0279.342] lstrlenW (lpString=".jpg") returned 4 [0279.342] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.342] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.342] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.343] GetLastError () returned 0x0 [0279.343] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0279.352] WriteFile (in: hFile=0x214, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0279.354] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.354] WriteFile (in: hFile=0x214, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.354] SetEndOfFile (hFile=0x214) returned 1 [0279.354] CloseHandle (hObject=0x214) returned 1 [0279.354] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.354] SetEndOfFile (hFile=0x1e0) returned 1 [0279.355] CloseHandle (hObject=0x1e0) returned 1 [0279.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0279.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0279.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0279.356] lstrlenW (lpString=".doc") returned 4 [0279.356] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.356] lstrlenW (lpString=".docx") returned 5 [0279.356] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.356] lstrlenW (lpString=".pdf") returned 4 [0279.356] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.356] lstrlenW (lpString=".xls") returned 4 [0279.356] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.356] lstrlenW (lpString=".xlsx") returned 5 [0279.356] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.356] lstrlenW (lpString=".ppt") returned 4 [0279.356] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0279.357] lstrlenW (lpString=".zip") returned 4 [0279.357] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.357] lstrlenW (lpString=".rar") returned 4 [0279.357] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.357] lstrlenW (lpString=".bz2") returned 4 [0279.357] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.357] lstrlenW (lpString=".7z") returned 3 [0279.357] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0279.357] lstrlenW (lpString=".dbf") returned 4 [0279.357] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0279.357] lstrlenW (lpString=".1cd") returned 4 [0279.357] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0279.357] lstrlenW (lpString=".jpg") returned 4 [0279.357] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.357] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.358] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0279.368] GetLastError () returned 0x0 [0279.368] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xf82, lpOverlapped=0x0) returned 1 [0279.383] WriteFile (in: hFile=0x210, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0279.385] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.385] WriteFile (in: hFile=0x210, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.386] SetEndOfFile (hFile=0x210) returned 1 [0279.386] CloseHandle (hObject=0x210) returned 1 [0279.386] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.386] SetEndOfFile (hFile=0x1e0) returned 1 [0279.387] CloseHandle (hObject=0x1e0) returned 1 [0279.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.387] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0279.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0279.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0279.388] lstrlenW (lpString=".doc") returned 4 [0279.388] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.388] lstrlenW (lpString=".docx") returned 5 [0279.388] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.388] lstrlenW (lpString=".pdf") returned 4 [0279.388] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.388] lstrlenW (lpString=".xls") returned 4 [0279.388] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.388] lstrlenW (lpString=".xlsx") returned 5 [0279.388] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.388] lstrlenW (lpString=".ppt") returned 4 [0279.388] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0279.388] lstrlenW (lpString=".zip") returned 4 [0279.388] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.388] lstrlenW (lpString=".rar") returned 4 [0279.388] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.388] lstrlenW (lpString=".bz2") returned 4 [0279.388] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.388] lstrlenW (lpString=".7z") returned 3 [0279.388] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0279.388] lstrlenW (lpString=".dbf") returned 4 [0279.388] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0279.389] lstrlenW (lpString=".1cd") returned 4 [0279.389] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0279.389] lstrlenW (lpString=".jpg") returned 4 [0279.389] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.389] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.389] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0279.716] GetLastError () returned 0x0 [0279.716] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0280.177] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0280.178] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.178] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0280.179] SetEndOfFile (hFile=0x1e4) returned 1 [0280.179] CloseHandle (hObject=0x1e4) returned 1 [0280.179] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.179] SetEndOfFile (hFile=0x1e0) returned 1 [0280.180] CloseHandle (hObject=0x1e0) returned 1 [0280.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0280.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0280.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0280.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0280.181] lstrlenW (lpString=".doc") returned 4 [0280.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0280.181] lstrlenW (lpString=".docx") returned 5 [0280.181] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0280.181] lstrlenW (lpString=".pdf") returned 4 [0280.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0280.181] lstrlenW (lpString=".xls") returned 4 [0280.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0280.181] lstrlenW (lpString=".xlsx") returned 5 [0280.181] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0280.181] lstrlenW (lpString=".ppt") returned 4 [0280.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0280.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0280.181] lstrlenW (lpString=".zip") returned 4 [0280.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0280.181] lstrlenW (lpString=".rar") returned 4 [0280.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0280.181] lstrlenW (lpString=".bz2") returned 4 [0280.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0280.182] lstrlenW (lpString=".7z") returned 3 [0280.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0280.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0280.182] lstrlenW (lpString=".dbf") returned 4 [0280.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0280.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0280.182] lstrlenW (lpString=".1cd") returned 4 [0280.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0280.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0280.182] lstrlenW (lpString=".jpg") returned 4 [0280.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0280.182] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.182] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0280.397] GetLastError () returned 0x0 [0280.397] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0281.413] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0281.414] ReadFile (in: hFile=0x1e0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.414] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.414] SetEndOfFile (hFile=0x1f4) returned 1 [0281.414] CloseHandle (hObject=0x1f4) returned 1 [0281.414] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.414] SetEndOfFile (hFile=0x1e0) returned 1 [0281.415] CloseHandle (hObject=0x1e0) returned 1 [0281.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0281.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0281.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0281.416] lstrlenW (lpString=".doc") returned 4 [0281.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.416] lstrlenW (lpString=".docx") returned 5 [0281.416] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.416] lstrlenW (lpString=".pdf") returned 4 [0281.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.416] lstrlenW (lpString=".xls") returned 4 [0281.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.417] lstrlenW (lpString=".xlsx") returned 5 [0281.417] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.417] lstrlenW (lpString=".ppt") returned 4 [0281.417] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0281.417] lstrlenW (lpString=".zip") returned 4 [0281.417] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.417] lstrlenW (lpString=".rar") returned 4 [0281.417] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.417] lstrlenW (lpString=".bz2") returned 4 [0281.417] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.417] lstrlenW (lpString=".7z") returned 3 [0281.417] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0281.417] lstrlenW (lpString=".dbf") returned 4 [0281.417] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0281.417] lstrlenW (lpString=".1cd") returned 4 [0281.417] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0281.417] lstrlenW (lpString=".jpg") returned 4 [0281.417] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.428] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.428] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0281.429] GetLastError () returned 0x0 [0281.429] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x5534, lpOverlapped=0x0) returned 1 [0281.468] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0281.470] ReadFile (in: hFile=0x1c4, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.470] WriteFile (in: hFile=0x1e4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.470] SetEndOfFile (hFile=0x1e4) returned 1 [0281.470] CloseHandle (hObject=0x1e4) returned 1 [0281.470] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.470] SetEndOfFile (hFile=0x1c4) returned 1 [0281.472] CloseHandle (hObject=0x1c4) returned 1 [0281.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0281.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0281.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0281.473] lstrlenW (lpString=".doc") returned 4 [0281.473] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.473] lstrlenW (lpString=".docx") returned 5 [0281.473] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.473] lstrlenW (lpString=".pdf") returned 4 [0281.473] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.473] lstrlenW (lpString=".xls") returned 4 [0281.473] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.473] lstrlenW (lpString=".xlsx") returned 5 [0281.473] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.473] lstrlenW (lpString=".ppt") returned 4 [0281.473] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0281.473] lstrlenW (lpString=".zip") returned 4 [0281.473] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.473] lstrlenW (lpString=".rar") returned 4 [0281.473] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.473] lstrlenW (lpString=".bz2") returned 4 [0281.473] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.473] lstrlenW (lpString=".7z") returned 3 [0281.474] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0281.474] lstrlenW (lpString=".dbf") returned 4 [0281.474] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0281.474] lstrlenW (lpString=".1cd") returned 4 [0281.474] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0281.474] lstrlenW (lpString=".jpg") returned 4 [0281.474] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.491] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.491] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0281.491] GetLastError () returned 0x0 [0281.491] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0281.782] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0281.943] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.943] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.943] SetEndOfFile (hFile=0x1f4) returned 1 [0281.944] CloseHandle (hObject=0x1f4) returned 1 [0281.944] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.944] SetEndOfFile (hFile=0x1c0) returned 1 [0281.945] CloseHandle (hObject=0x1c0) returned 1 [0281.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0281.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0281.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0281.945] lstrlenW (lpString=".doc") returned 4 [0281.945] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.945] lstrlenW (lpString=".docx") returned 5 [0281.945] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.945] lstrlenW (lpString=".pdf") returned 4 [0281.945] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.945] lstrlenW (lpString=".xls") returned 4 [0281.945] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.945] lstrlenW (lpString=".xlsx") returned 5 [0281.946] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.946] lstrlenW (lpString=".ppt") returned 4 [0281.946] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0281.946] lstrlenW (lpString=".zip") returned 4 [0281.946] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.946] lstrlenW (lpString=".rar") returned 4 [0281.946] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.946] lstrlenW (lpString=".bz2") returned 4 [0281.946] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.946] lstrlenW (lpString=".7z") returned 3 [0281.946] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0281.946] lstrlenW (lpString=".dbf") returned 4 [0281.946] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0281.946] lstrlenW (lpString=".1cd") returned 4 [0281.946] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0281.946] lstrlenW (lpString=".jpg") returned 4 [0281.946] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.946] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.947] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0281.947] GetLastError () returned 0x0 [0281.947] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0282.011] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0282.013] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.013] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0282.013] SetEndOfFile (hFile=0x1f4) returned 1 [0282.013] CloseHandle (hObject=0x1f4) returned 1 [0282.013] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.013] SetEndOfFile (hFile=0x1c0) returned 1 [0282.014] CloseHandle (hObject=0x1c0) returned 1 [0282.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0282.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0282.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0282.015] lstrlenW (lpString=".doc") returned 4 [0282.015] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0282.015] lstrlenW (lpString=".docx") returned 5 [0282.015] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0282.015] lstrlenW (lpString=".pdf") returned 4 [0282.015] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0282.015] lstrlenW (lpString=".xls") returned 4 [0282.016] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0282.016] lstrlenW (lpString=".xlsx") returned 5 [0282.016] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0282.016] lstrlenW (lpString=".ppt") returned 4 [0282.016] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0282.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0282.016] lstrlenW (lpString=".zip") returned 4 [0282.016] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0282.016] lstrlenW (lpString=".rar") returned 4 [0282.016] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0282.016] lstrlenW (lpString=".bz2") returned 4 [0282.016] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0282.016] lstrlenW (lpString=".7z") returned 3 [0282.016] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0282.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0282.016] lstrlenW (lpString=".dbf") returned 4 [0282.016] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0282.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0282.016] lstrlenW (lpString=".1cd") returned 4 [0282.016] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0282.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0282.016] lstrlenW (lpString=".jpg") returned 4 [0282.016] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0282.017] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.017] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0282.019] GetLastError () returned 0x0 [0282.020] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x623, lpOverlapped=0x0) returned 1 [0282.068] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x630, lpOverlapped=0x0) returned 1 [0282.069] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.069] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0282.069] SetEndOfFile (hFile=0x1f4) returned 1 [0282.069] CloseHandle (hObject=0x1f4) returned 1 [0282.069] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.069] SetEndOfFile (hFile=0x1c0) returned 1 [0282.070] CloseHandle (hObject=0x1c0) returned 1 [0282.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0282.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0282.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0282.071] lstrlenW (lpString=".doc") returned 4 [0282.071] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0282.071] lstrlenW (lpString=".docx") returned 5 [0282.071] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0282.071] lstrlenW (lpString=".pdf") returned 4 [0282.071] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0282.071] lstrlenW (lpString=".xls") returned 4 [0282.071] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0282.071] lstrlenW (lpString=".xlsx") returned 5 [0282.071] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0282.071] lstrlenW (lpString=".ppt") returned 4 [0282.071] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0282.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0282.071] lstrlenW (lpString=".zip") returned 4 [0282.071] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0282.071] lstrlenW (lpString=".rar") returned 4 [0282.071] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0282.071] lstrlenW (lpString=".bz2") returned 4 [0282.071] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0282.071] lstrlenW (lpString=".7z") returned 3 [0282.072] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0282.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0282.072] lstrlenW (lpString=".dbf") returned 4 [0282.072] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0282.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0282.072] lstrlenW (lpString=".1cd") returned 4 [0282.072] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0282.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0282.072] lstrlenW (lpString=".jpg") returned 4 [0282.072] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0282.417] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.418] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0282.418] GetLastError () returned 0x0 [0282.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0282.423] WriteFile (in: hFile=0x204, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0282.425] ReadFile (in: hFile=0x1b0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.425] WriteFile (in: hFile=0x204, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.425] SetEndOfFile (hFile=0x204) returned 1 [0282.425] CloseHandle (hObject=0x204) returned 1 [0282.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.426] SetEndOfFile (hFile=0x1b0) returned 1 [0282.428] CloseHandle (hObject=0x1b0) returned 1 [0282.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0282.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0282.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0282.429] lstrlenW (lpString=".doc") returned 4 [0282.429] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.429] lstrlenW (lpString=".docx") returned 5 [0282.429] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.429] lstrlenW (lpString=".pdf") returned 4 [0282.429] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.429] lstrlenW (lpString=".xls") returned 4 [0282.429] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.429] lstrlenW (lpString=".xlsx") returned 5 [0282.429] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.429] lstrlenW (lpString=".ppt") returned 4 [0282.429] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0282.429] lstrlenW (lpString=".zip") returned 4 [0282.429] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.429] lstrlenW (lpString=".rar") returned 4 [0282.429] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.429] lstrlenW (lpString=".bz2") returned 4 [0282.429] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.429] lstrlenW (lpString=".7z") returned 3 [0282.429] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0282.429] lstrlenW (lpString=".dbf") returned 4 [0282.430] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0282.430] lstrlenW (lpString=".1cd") returned 4 [0282.430] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0282.430] lstrlenW (lpString=".jpg") returned 4 [0282.430] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.597] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.597] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0282.597] GetLastError () returned 0x0 [0282.597] ReadFile (in: hFile=0x180, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0282.609] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0282.610] ReadFile (in: hFile=0x180, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.610] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0282.610] SetEndOfFile (hFile=0x1f4) returned 1 [0282.610] CloseHandle (hObject=0x1f4) returned 1 [0282.610] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.611] SetEndOfFile (hFile=0x180) returned 1 [0282.611] CloseHandle (hObject=0x180) returned 1 [0282.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0282.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0282.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0282.614] lstrlenW (lpString=".doc") returned 4 [0282.614] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString=".docx") returned 5 [0282.615] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0282.615] lstrlenW (lpString=".pdf") returned 4 [0282.615] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString=".xls") returned 4 [0282.615] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString=".xlsx") returned 5 [0282.615] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0282.615] lstrlenW (lpString=".ppt") returned 4 [0282.615] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0282.615] lstrlenW (lpString=".zip") returned 4 [0282.615] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString=".rar") returned 4 [0282.615] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString=".bz2") returned 4 [0282.615] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString=".7z") returned 3 [0282.615] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0282.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0282.615] lstrlenW (lpString=".dbf") returned 4 [0282.615] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0282.615] lstrlenW (lpString=".1cd") returned 4 [0282.615] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0282.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0282.615] lstrlenW (lpString=".jpg") returned 4 [0282.615] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0283.770] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0283.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0283.770] lstrlenW (lpString=".doc") returned 4 [0283.770] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.770] lstrlenW (lpString=".docx") returned 5 [0283.770] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0283.770] lstrlenW (lpString=".pdf") returned 4 [0283.770] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.770] lstrlenW (lpString=".xls") returned 4 [0283.770] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.770] lstrlenW (lpString=".xlsx") returned 5 [0283.770] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0283.770] lstrlenW (lpString=".ppt") returned 4 [0283.770] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0283.770] lstrlenW (lpString=".zip") returned 4 [0283.770] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.770] lstrlenW (lpString=".rar") returned 4 [0283.770] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.770] lstrlenW (lpString=".bz2") returned 4 [0283.770] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.770] lstrlenW (lpString=".7z") returned 3 [0283.770] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0283.770] lstrlenW (lpString=".dbf") returned 4 [0283.770] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.770] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0283.770] lstrlenW (lpString=".1cd") returned 4 [0283.771] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0283.771] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0283.771] lstrlenW (lpString=".jpg") returned 4 [0283.771] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0284.630] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.630] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0284.632] GetLastError () returned 0x0 [0284.632] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x4932, lpOverlapped=0x0) returned 1 [0284.671] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0284.672] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.672] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0284.672] SetEndOfFile (hFile=0x180) returned 1 [0284.990] CloseHandle (hObject=0x180) returned 1 [0284.990] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.990] SetEndOfFile (hFile=0x1f0) returned 1 [0284.991] CloseHandle (hObject=0x1f0) returned 1 [0284.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0284.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0284.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0284.992] lstrlenW (lpString=".doc") returned 4 [0284.992] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0284.992] lstrlenW (lpString=".docx") returned 5 [0284.992] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0284.992] lstrlenW (lpString=".pdf") returned 4 [0284.992] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0284.992] lstrlenW (lpString=".xls") returned 4 [0284.992] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0284.992] lstrlenW (lpString=".xlsx") returned 5 [0284.992] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0284.992] lstrlenW (lpString=".ppt") returned 4 [0284.992] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0284.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0284.992] lstrlenW (lpString=".zip") returned 4 [0284.992] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0284.992] lstrlenW (lpString=".rar") returned 4 [0284.993] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0284.993] lstrlenW (lpString=".bz2") returned 4 [0284.993] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0284.994] lstrlenW (lpString=".7z") returned 3 [0284.994] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0284.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0284.994] lstrlenW (lpString=".dbf") returned 4 [0284.994] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0284.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0284.994] lstrlenW (lpString=".1cd") returned 4 [0284.994] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0284.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0284.994] lstrlenW (lpString=".jpg") returned 4 [0284.994] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0284.995] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.995] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0284.995] GetLastError () returned 0x0 [0284.995] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0285.045] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0285.046] ReadFile (in: hFile=0x1f0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.046] WriteFile (in: hFile=0x180, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0285.046] SetEndOfFile (hFile=0x180) returned 1 [0285.046] CloseHandle (hObject=0x180) returned 1 [0285.046] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.047] SetEndOfFile (hFile=0x1f0) returned 1 [0285.048] CloseHandle (hObject=0x1f0) returned 1 [0285.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0285.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0285.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0285.066] lstrlenW (lpString=".doc") returned 4 [0285.066] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0285.066] lstrlenW (lpString=".docx") returned 5 [0285.066] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0285.066] lstrlenW (lpString=".pdf") returned 4 [0285.066] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0285.066] lstrlenW (lpString=".xls") returned 4 [0285.067] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0285.067] lstrlenW (lpString=".xlsx") returned 5 [0285.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0285.067] lstrlenW (lpString=".ppt") returned 4 [0285.067] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0285.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0285.067] lstrlenW (lpString=".zip") returned 4 [0285.067] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0285.067] lstrlenW (lpString=".rar") returned 4 [0285.067] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0285.067] lstrlenW (lpString=".bz2") returned 4 [0285.067] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0285.067] lstrlenW (lpString=".7z") returned 3 [0285.067] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0285.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0285.067] lstrlenW (lpString=".dbf") returned 4 [0285.067] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0285.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0285.067] lstrlenW (lpString=".1cd") returned 4 [0285.067] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0285.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0285.067] lstrlenW (lpString=".jpg") returned 4 [0285.067] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0285.111] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.112] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0285.112] GetLastError () returned 0x0 [0285.112] ReadFile (in: hFile=0x180, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x2340, lpOverlapped=0x0) returned 1 [0285.197] WriteFile (in: hFile=0x1c4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0285.198] ReadFile (in: hFile=0x180, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.198] WriteFile (in: hFile=0x1c4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.198] SetEndOfFile (hFile=0x1c4) returned 1 [0285.198] CloseHandle (hObject=0x1c4) returned 1 [0285.198] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.198] SetEndOfFile (hFile=0x180) returned 1 [0285.199] CloseHandle (hObject=0x180) returned 1 [0285.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0285.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0285.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0285.200] lstrlenW (lpString=".doc") returned 4 [0285.200] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.200] lstrlenW (lpString=".docx") returned 5 [0285.200] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.200] lstrlenW (lpString=".pdf") returned 4 [0285.200] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.200] lstrlenW (lpString=".xls") returned 4 [0285.200] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.200] lstrlenW (lpString=".xlsx") returned 5 [0285.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.200] lstrlenW (lpString=".ppt") returned 4 [0285.200] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0285.200] lstrlenW (lpString=".zip") returned 4 [0285.200] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.200] lstrlenW (lpString=".rar") returned 4 [0285.200] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.200] lstrlenW (lpString=".bz2") returned 4 [0285.200] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.200] lstrlenW (lpString=".7z") returned 3 [0285.200] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0285.200] lstrlenW (lpString=".dbf") returned 4 [0285.201] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0285.201] lstrlenW (lpString=".1cd") returned 4 [0285.201] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0285.201] lstrlenW (lpString=".jpg") returned 4 [0285.201] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.500] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.500] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0285.501] GetLastError () returned 0x0 [0285.501] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0285.776] WriteFile (in: hFile=0x174, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0285.851] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.851] WriteFile (in: hFile=0x174, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.851] SetEndOfFile (hFile=0x174) returned 1 [0285.851] CloseHandle (hObject=0x174) returned 1 [0285.852] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.852] SetEndOfFile (hFile=0x1c0) returned 1 [0285.853] CloseHandle (hObject=0x1c0) returned 1 [0285.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0285.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0285.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0285.854] lstrlenW (lpString=".doc") returned 4 [0285.854] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.854] lstrlenW (lpString=".docx") returned 5 [0285.854] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.854] lstrlenW (lpString=".pdf") returned 4 [0285.854] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.854] lstrlenW (lpString=".xls") returned 4 [0285.854] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.854] lstrlenW (lpString=".xlsx") returned 5 [0285.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.854] lstrlenW (lpString=".ppt") returned 4 [0285.854] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0285.854] lstrlenW (lpString=".zip") returned 4 [0285.854] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.854] lstrlenW (lpString=".rar") returned 4 [0285.854] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.854] lstrlenW (lpString=".bz2") returned 4 [0285.854] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.854] lstrlenW (lpString=".7z") returned 3 [0285.854] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0285.854] lstrlenW (lpString=".dbf") returned 4 [0285.854] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0285.854] lstrlenW (lpString=".1cd") returned 4 [0285.854] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0285.854] lstrlenW (lpString=".jpg") returned 4 [0285.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.855] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.855] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0285.855] GetLastError () returned 0x0 [0285.855] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x205, lpOverlapped=0x0) returned 1 [0285.856] WriteFile (in: hFile=0x174, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x210, lpOverlapped=0x0) returned 1 [0285.857] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.857] WriteFile (in: hFile=0x174, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.858] SetEndOfFile (hFile=0x174) returned 1 [0285.858] CloseHandle (hObject=0x174) returned 1 [0285.859] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.859] SetEndOfFile (hFile=0x1c0) returned 1 [0285.859] CloseHandle (hObject=0x1c0) returned 1 [0285.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0285.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0285.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0285.860] lstrlenW (lpString=".doc") returned 4 [0285.860] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.860] lstrlenW (lpString=".docx") returned 5 [0285.860] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.860] lstrlenW (lpString=".pdf") returned 4 [0285.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.860] lstrlenW (lpString=".xls") returned 4 [0285.860] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.860] lstrlenW (lpString=".xlsx") returned 5 [0285.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.860] lstrlenW (lpString=".ppt") returned 4 [0285.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0285.861] lstrlenW (lpString=".zip") returned 4 [0285.861] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.861] lstrlenW (lpString=".rar") returned 4 [0285.861] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.861] lstrlenW (lpString=".bz2") returned 4 [0285.861] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.861] lstrlenW (lpString=".7z") returned 3 [0285.861] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0285.861] lstrlenW (lpString=".dbf") returned 4 [0285.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0285.861] lstrlenW (lpString=".1cd") returned 4 [0285.861] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0285.861] lstrlenW (lpString=".jpg") returned 4 [0285.861] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.865] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.865] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0285.866] GetLastError () returned 0x0 [0285.866] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0285.867] WriteFile (in: hFile=0x174, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x200, lpOverlapped=0x0) returned 1 [0285.868] ReadFile (in: hFile=0x1c0, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.868] WriteFile (in: hFile=0x174, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.868] SetEndOfFile (hFile=0x174) returned 1 [0285.868] CloseHandle (hObject=0x174) returned 1 [0285.869] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.869] SetEndOfFile (hFile=0x1c0) returned 1 [0285.869] CloseHandle (hObject=0x1c0) returned 1 [0285.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0285.871] lstrlenW (lpString=".doc") returned 4 [0285.871] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.871] lstrlenW (lpString=".docx") returned 5 [0285.871] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.871] lstrlenW (lpString=".pdf") returned 4 [0285.871] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.871] lstrlenW (lpString=".xls") returned 4 [0285.871] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.871] lstrlenW (lpString=".xlsx") returned 5 [0285.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.871] lstrlenW (lpString=".ppt") returned 4 [0285.871] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0285.871] lstrlenW (lpString=".zip") returned 4 [0285.871] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.871] lstrlenW (lpString=".rar") returned 4 [0285.871] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.871] lstrlenW (lpString=".bz2") returned 4 [0285.871] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.871] lstrlenW (lpString=".7z") returned 3 [0285.871] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0285.871] lstrlenW (lpString=".dbf") returned 4 [0285.872] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0285.872] lstrlenW (lpString=".1cd") returned 4 [0285.872] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0285.872] lstrlenW (lpString=".jpg") returned 4 [0285.872] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.557] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.557] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0286.558] GetLastError () returned 0x0 [0286.558] ReadFile (in: hFile=0x180, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x319e, lpOverlapped=0x0) returned 1 [0286.578] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0286.579] ReadFile (in: hFile=0x180, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.579] WriteFile (in: hFile=0x1f4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.579] SetEndOfFile (hFile=0x1f4) returned 1 [0286.580] CloseHandle (hObject=0x1f4) returned 1 [0286.580] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.580] SetEndOfFile (hFile=0x180) returned 1 [0286.581] CloseHandle (hObject=0x180) returned 1 [0286.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0286.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0286.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0286.586] lstrlenW (lpString=".doc") returned 4 [0286.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.586] lstrlenW (lpString=".docx") returned 5 [0286.586] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.586] lstrlenW (lpString=".pdf") returned 4 [0286.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.586] lstrlenW (lpString=".xls") returned 4 [0286.586] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.586] lstrlenW (lpString=".xlsx") returned 5 [0286.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.586] lstrlenW (lpString=".ppt") returned 4 [0286.586] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0286.587] lstrlenW (lpString=".zip") returned 4 [0286.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.587] lstrlenW (lpString=".rar") returned 4 [0286.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.587] lstrlenW (lpString=".bz2") returned 4 [0286.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.587] lstrlenW (lpString=".7z") returned 3 [0286.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0286.587] lstrlenW (lpString=".dbf") returned 4 [0286.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0286.587] lstrlenW (lpString=".1cd") returned 4 [0286.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0286.587] lstrlenW (lpString=".jpg") returned 4 [0286.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.589] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.589] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0286.590] GetLastError () returned 0x0 [0286.590] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x296f, lpOverlapped=0x0) returned 1 [0286.630] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0286.631] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.631] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.631] SetEndOfFile (hFile=0x1f0) returned 1 [0286.631] CloseHandle (hObject=0x1f0) returned 1 [0286.632] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.632] SetEndOfFile (hFile=0x1c8) returned 1 [0286.632] CloseHandle (hObject=0x1c8) returned 1 [0286.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0286.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0286.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0286.633] lstrlenW (lpString=".doc") returned 4 [0286.633] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.633] lstrlenW (lpString=".docx") returned 5 [0286.633] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.633] lstrlenW (lpString=".pdf") returned 4 [0286.633] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.633] lstrlenW (lpString=".xls") returned 4 [0286.633] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.633] lstrlenW (lpString=".xlsx") returned 5 [0286.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.633] lstrlenW (lpString=".ppt") returned 4 [0286.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0286.633] lstrlenW (lpString=".zip") returned 4 [0286.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.634] lstrlenW (lpString=".rar") returned 4 [0286.634] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.634] lstrlenW (lpString=".bz2") returned 4 [0286.634] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.634] lstrlenW (lpString=".7z") returned 3 [0286.634] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0286.634] lstrlenW (lpString=".dbf") returned 4 [0286.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0286.634] lstrlenW (lpString=".1cd") returned 4 [0286.634] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0286.634] lstrlenW (lpString=".jpg") returned 4 [0286.634] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.640] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.641] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0286.642] GetLastError () returned 0x0 [0286.642] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0286.679] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0286.680] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.680] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.680] SetEndOfFile (hFile=0x1f0) returned 1 [0286.681] CloseHandle (hObject=0x1f0) returned 1 [0286.681] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.681] SetEndOfFile (hFile=0x1c8) returned 1 [0286.684] CloseHandle (hObject=0x1c8) returned 1 [0286.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0286.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0286.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0286.684] lstrlenW (lpString=".doc") returned 4 [0286.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.684] lstrlenW (lpString=".docx") returned 5 [0286.684] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.684] lstrlenW (lpString=".pdf") returned 4 [0286.684] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.684] lstrlenW (lpString=".xls") returned 4 [0286.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.685] lstrlenW (lpString=".xlsx") returned 5 [0286.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.685] lstrlenW (lpString=".ppt") returned 4 [0286.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0286.685] lstrlenW (lpString=".zip") returned 4 [0286.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.685] lstrlenW (lpString=".rar") returned 4 [0286.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.685] lstrlenW (lpString=".bz2") returned 4 [0286.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.685] lstrlenW (lpString=".7z") returned 3 [0286.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0286.685] lstrlenW (lpString=".dbf") returned 4 [0286.685] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0286.685] lstrlenW (lpString=".1cd") returned 4 [0286.685] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0286.685] lstrlenW (lpString=".jpg") returned 4 [0286.685] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.687] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.687] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0286.688] GetLastError () returned 0x0 [0286.688] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0286.816] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0287.144] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.144] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.145] SetEndOfFile (hFile=0x1f0) returned 1 [0287.145] CloseHandle (hObject=0x1f0) returned 1 [0287.145] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.145] SetEndOfFile (hFile=0x1c8) returned 1 [0287.146] CloseHandle (hObject=0x1c8) returned 1 [0287.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0287.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0287.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0287.147] lstrlenW (lpString=".doc") returned 4 [0287.147] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.147] lstrlenW (lpString=".docx") returned 5 [0287.147] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.147] lstrlenW (lpString=".pdf") returned 4 [0287.147] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.147] lstrlenW (lpString=".xls") returned 4 [0287.147] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.147] lstrlenW (lpString=".xlsx") returned 5 [0287.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.147] lstrlenW (lpString=".ppt") returned 4 [0287.147] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0287.147] lstrlenW (lpString=".zip") returned 4 [0287.147] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.147] lstrlenW (lpString=".rar") returned 4 [0287.147] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.147] lstrlenW (lpString=".bz2") returned 4 [0287.147] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.147] lstrlenW (lpString=".7z") returned 3 [0287.148] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0287.148] lstrlenW (lpString=".dbf") returned 4 [0287.148] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0287.148] lstrlenW (lpString=".1cd") returned 4 [0287.148] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0287.148] lstrlenW (lpString=".jpg") returned 4 [0287.148] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.149] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.149] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0287.150] GetLastError () returned 0x0 [0287.150] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0287.155] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0287.156] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.156] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.156] SetEndOfFile (hFile=0x1f0) returned 1 [0287.157] CloseHandle (hObject=0x1f0) returned 1 [0287.157] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.157] SetEndOfFile (hFile=0x1c8) returned 1 [0287.158] CloseHandle (hObject=0x1c8) returned 1 [0287.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0287.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0287.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0287.159] lstrlenW (lpString=".doc") returned 4 [0287.159] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.159] lstrlenW (lpString=".docx") returned 5 [0287.159] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.159] lstrlenW (lpString=".pdf") returned 4 [0287.159] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.159] lstrlenW (lpString=".xls") returned 4 [0287.159] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.159] lstrlenW (lpString=".xlsx") returned 5 [0287.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.159] lstrlenW (lpString=".ppt") returned 4 [0287.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0287.160] lstrlenW (lpString=".zip") returned 4 [0287.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.160] lstrlenW (lpString=".rar") returned 4 [0287.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.160] lstrlenW (lpString=".bz2") returned 4 [0287.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.160] lstrlenW (lpString=".7z") returned 3 [0287.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0287.160] lstrlenW (lpString=".dbf") returned 4 [0287.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0287.160] lstrlenW (lpString=".1cd") returned 4 [0287.160] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0287.160] lstrlenW (lpString=".jpg") returned 4 [0287.160] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.161] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.161] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0287.161] GetLastError () returned 0x0 [0287.161] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x2420, lpOverlapped=0x0) returned 1 [0287.179] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0287.180] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.180] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.180] SetEndOfFile (hFile=0x1f0) returned 1 [0287.180] CloseHandle (hObject=0x1f0) returned 1 [0287.181] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.181] SetEndOfFile (hFile=0x1c8) returned 1 [0287.181] CloseHandle (hObject=0x1c8) returned 1 [0287.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0287.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0287.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0287.192] lstrlenW (lpString=".doc") returned 4 [0287.192] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.192] lstrlenW (lpString=".docx") returned 5 [0287.192] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.192] lstrlenW (lpString=".pdf") returned 4 [0287.192] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.192] lstrlenW (lpString=".xls") returned 4 [0287.192] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.192] lstrlenW (lpString=".xlsx") returned 5 [0287.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.192] lstrlenW (lpString=".ppt") returned 4 [0287.192] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0287.192] lstrlenW (lpString=".zip") returned 4 [0287.192] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.192] lstrlenW (lpString=".rar") returned 4 [0287.192] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.192] lstrlenW (lpString=".bz2") returned 4 [0287.192] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.192] lstrlenW (lpString=".7z") returned 3 [0287.192] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0287.192] lstrlenW (lpString=".dbf") returned 4 [0287.192] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0287.192] lstrlenW (lpString=".1cd") returned 4 [0287.192] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0287.193] lstrlenW (lpString=".jpg") returned 4 [0287.193] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.193] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3966) returned 1 [0287.193] CloseHandle (hObject=0x1c8) returned 1 [0287.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0287.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0287.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0287.194] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.194] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0287.194] GetLastError () returned 0x0 [0287.194] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0287.200] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0287.201] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.201] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.201] SetEndOfFile (hFile=0x1f0) returned 1 [0287.201] CloseHandle (hObject=0x1f0) returned 1 [0287.201] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.201] SetEndOfFile (hFile=0x1c8) returned 1 [0287.202] CloseHandle (hObject=0x1c8) returned 1 [0287.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0287.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0287.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0287.203] lstrlenW (lpString=".doc") returned 4 [0287.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.203] lstrlenW (lpString=".docx") returned 5 [0287.203] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.203] lstrlenW (lpString=".pdf") returned 4 [0287.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.203] lstrlenW (lpString=".xls") returned 4 [0287.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.203] lstrlenW (lpString=".xlsx") returned 5 [0287.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.203] lstrlenW (lpString=".ppt") returned 4 [0287.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0287.203] lstrlenW (lpString=".zip") returned 4 [0287.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.203] lstrlenW (lpString=".rar") returned 4 [0287.204] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.204] lstrlenW (lpString=".bz2") returned 4 [0287.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.204] lstrlenW (lpString=".7z") returned 3 [0287.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0287.204] lstrlenW (lpString=".dbf") returned 4 [0287.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0287.204] lstrlenW (lpString=".1cd") returned 4 [0287.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0287.204] lstrlenW (lpString=".jpg") returned 4 [0287.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.204] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.204] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0287.205] GetLastError () returned 0x0 [0287.205] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0xc30, lpOverlapped=0x0) returned 1 [0287.271] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0287.272] ReadFile (in: hFile=0x1c8, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.272] WriteFile (in: hFile=0x1f0, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.272] SetEndOfFile (hFile=0x1f0) returned 1 [0287.272] CloseHandle (hObject=0x1f0) returned 1 [0287.273] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.273] SetEndOfFile (hFile=0x1c8) returned 1 [0287.274] CloseHandle (hObject=0x1c8) returned 1 [0287.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0287.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0287.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0287.687] lstrlenW (lpString=".doc") returned 4 [0287.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.687] lstrlenW (lpString=".docx") returned 5 [0287.687] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.687] lstrlenW (lpString=".pdf") returned 4 [0287.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.687] lstrlenW (lpString=".xls") returned 4 [0287.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.687] lstrlenW (lpString=".xlsx") returned 5 [0287.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.687] lstrlenW (lpString=".ppt") returned 4 [0287.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0287.687] lstrlenW (lpString=".zip") returned 4 [0287.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.687] lstrlenW (lpString=".rar") returned 4 [0287.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.687] lstrlenW (lpString=".bz2") returned 4 [0287.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.687] lstrlenW (lpString=".7z") returned 3 [0287.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0287.687] lstrlenW (lpString=".dbf") returned 4 [0287.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0287.687] lstrlenW (lpString=".1cd") returned 4 [0287.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0287.688] lstrlenW (lpString=".jpg") returned 4 [0287.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 Thread: id = 12 os_tid = 0x8d8 [0260.786] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3c0ab8 [0260.786] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3880048 [0260.787] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304e0 [0260.787] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x333220 [0260.787] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3304f8 [0260.787] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3980020 [0260.787] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330510 [0260.787] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330510, Size=0x20) returned 0x35fb00 [0260.787] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330510 [0260.787] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330510, Size=0x20) returned 0x35fad8 [0260.787] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.788] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.788] Wow64DisableWow64FsRedirection (in: OldValue=0x2dcff58 | out: OldValue=0x2dcff58*=0x0) returned 1 [0260.788] lstrlenW (lpString="kernel32.dll") returned 12 [0260.788] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.788] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.788] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.788] Sleep (dwMilliseconds=0x64) [0261.293] lstrlenW (lpString="BCD") returned 3 [0261.293] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.298] lstrlenW (lpString=".doc") returned 4 [0261.298] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0261.298] lstrlenW (lpString=".docx") returned 5 [0261.298] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0261.298] lstrlenW (lpString=".pdf") returned 4 [0261.298] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0261.298] lstrlenW (lpString=".xls") returned 4 [0261.298] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0261.298] lstrlenW (lpString=".xlsx") returned 5 [0261.298] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0261.298] lstrlenW (lpString=".ppt") returned 4 [0261.298] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0261.298] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.298] lstrlenW (lpString=".zip") returned 4 [0261.298] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0261.298] lstrlenW (lpString=".rar") returned 4 [0261.299] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0261.299] lstrlenW (lpString=".bz2") returned 4 [0261.299] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0261.299] lstrlenW (lpString=".7z") returned 3 [0261.299] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0261.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.299] lstrlenW (lpString=".dbf") returned 4 [0261.299] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0261.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.299] lstrlenW (lpString=".1cd") returned 4 [0261.299] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0261.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.299] lstrlenW (lpString=".jpg") returned 4 [0261.299] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0261.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.299] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.299] lstrlenW (lpString=".doc") returned 4 [0261.299] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0261.299] lstrlenW (lpString=".docx") returned 5 [0261.300] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0261.300] lstrlenW (lpString=".pdf") returned 4 [0261.300] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0261.300] lstrlenW (lpString=".xls") returned 4 [0261.300] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0261.300] lstrlenW (lpString=".xlsx") returned 5 [0261.300] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0261.300] lstrlenW (lpString=".ppt") returned 4 [0261.300] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0261.300] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.300] lstrlenW (lpString=".zip") returned 4 [0261.300] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0261.300] lstrlenW (lpString=".rar") returned 4 [0261.300] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0261.300] lstrlenW (lpString=".bz2") returned 4 [0261.300] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0261.300] lstrlenW (lpString=".7z") returned 3 [0261.300] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0261.300] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.300] lstrlenW (lpString=".dbf") returned 4 [0261.301] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0261.301] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.301] lstrlenW (lpString=".1cd") returned 4 [0261.301] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0261.301] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0261.301] lstrlenW (lpString=".jpg") returned 4 [0261.301] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0261.301] lstrcmpiW (lpString1=".LOG2", lpString2=".drweb") returned 1 [0261.301] lstrlenW (lpString="BCD.LOG2") returned 8 [0261.301] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0261.302] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=0) returned 1 [0261.302] CloseHandle (hObject=0x168) returned 1 [0261.303] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.303] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.303] lstrlenW (lpString=".doc") returned 4 [0261.303] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0261.303] lstrlenW (lpString=".docx") returned 5 [0261.303] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0261.303] lstrlenW (lpString=".pdf") returned 4 [0261.303] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0261.303] lstrlenW (lpString=".xls") returned 4 [0261.303] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0261.303] lstrlenW (lpString=".xlsx") returned 5 [0261.303] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0261.303] lstrlenW (lpString=".ppt") returned 4 [0261.303] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0261.304] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.304] lstrlenW (lpString=".zip") returned 4 [0261.304] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0261.304] lstrlenW (lpString=".rar") returned 4 [0261.304] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0261.304] lstrlenW (lpString=".bz2") returned 4 [0261.304] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0261.304] lstrlenW (lpString=".7z") returned 3 [0261.304] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0261.304] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.304] lstrlenW (lpString=".dbf") returned 4 [0261.304] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0261.304] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.304] lstrlenW (lpString=".1cd") returned 4 [0261.304] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0261.304] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.304] lstrlenW (lpString=".jpg") returned 4 [0261.304] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0261.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.305] lstrlenW (lpString=".doc") returned 4 [0261.305] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0261.305] lstrlenW (lpString=".docx") returned 5 [0261.305] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0261.305] lstrlenW (lpString=".pdf") returned 4 [0261.305] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0261.305] lstrlenW (lpString=".xls") returned 4 [0261.305] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0261.305] lstrlenW (lpString=".xlsx") returned 5 [0261.305] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0261.305] lstrlenW (lpString=".ppt") returned 4 [0261.305] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0261.305] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.305] lstrlenW (lpString=".zip") returned 4 [0261.305] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0261.305] lstrlenW (lpString=".rar") returned 4 [0261.306] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0261.306] lstrlenW (lpString=".bz2") returned 4 [0261.306] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0261.306] lstrlenW (lpString=".7z") returned 3 [0261.306] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0261.306] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.306] lstrlenW (lpString=".dbf") returned 4 [0261.306] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0261.306] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.306] lstrlenW (lpString=".1cd") returned 4 [0261.307] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0261.307] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0261.307] lstrlenW (lpString=".jpg") returned 4 [0261.307] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0261.307] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.307] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.307] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0261.307] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=89168) returned 1 [0261.308] CloseHandle (hObject=0x168) returned 1 [0261.308] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0261.308] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.308] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.308] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.308] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.308] lstrlenW (lpString=".doc") returned 4 [0261.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.308] lstrlenW (lpString=".docx") returned 5 [0261.308] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.308] lstrlenW (lpString=".pdf") returned 4 [0261.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.309] lstrlenW (lpString=".xls") returned 4 [0261.309] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.309] lstrlenW (lpString=".xlsx") returned 5 [0261.309] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.309] lstrlenW (lpString=".ppt") returned 4 [0261.309] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.309] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.309] lstrlenW (lpString=".zip") returned 4 [0261.309] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.309] lstrlenW (lpString=".rar") returned 4 [0261.309] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.309] lstrlenW (lpString=".bz2") returned 4 [0261.309] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.309] lstrlenW (lpString=".7z") returned 3 [0261.309] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.309] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.309] lstrlenW (lpString=".dbf") returned 4 [0261.309] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.309] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.310] lstrlenW (lpString=".1cd") returned 4 [0261.310] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.310] lstrlenW (lpString=".jpg") returned 4 [0261.310] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.310] lstrlenW (lpString=".doc") returned 4 [0261.310] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.310] lstrlenW (lpString=".docx") returned 5 [0261.310] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.310] lstrlenW (lpString=".pdf") returned 4 [0261.310] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.310] lstrlenW (lpString=".xls") returned 4 [0261.310] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.310] lstrlenW (lpString=".xlsx") returned 5 [0261.310] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.310] lstrlenW (lpString=".ppt") returned 4 [0261.310] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.310] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.310] lstrlenW (lpString=".zip") returned 4 [0261.310] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.310] lstrlenW (lpString=".rar") returned 4 [0261.310] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.310] lstrlenW (lpString=".bz2") returned 4 [0261.310] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.310] lstrlenW (lpString=".7z") returned 3 [0261.310] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.311] lstrlenW (lpString=".dbf") returned 4 [0261.311] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.311] lstrlenW (lpString=".1cd") returned 4 [0261.311] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.311] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0261.311] lstrlenW (lpString=".jpg") returned 4 [0261.311] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.311] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.311] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.311] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0261.311] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=87616) returned 1 [0261.311] CloseHandle (hObject=0x168) returned 1 [0261.312] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0261.312] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.312] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.312] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.312] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.312] lstrlenW (lpString=".doc") returned 4 [0261.312] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.312] lstrlenW (lpString=".docx") returned 5 [0261.312] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.312] lstrlenW (lpString=".pdf") returned 4 [0261.312] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.312] lstrlenW (lpString=".xls") returned 4 [0261.312] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.312] lstrlenW (lpString=".xlsx") returned 5 [0261.312] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.312] lstrlenW (lpString=".ppt") returned 4 [0261.312] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.312] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.312] lstrlenW (lpString=".zip") returned 4 [0261.312] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.312] lstrlenW (lpString=".rar") returned 4 [0261.312] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.312] lstrlenW (lpString=".bz2") returned 4 [0261.313] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.313] lstrlenW (lpString=".7z") returned 3 [0261.313] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.313] lstrlenW (lpString=".dbf") returned 4 [0261.313] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.313] lstrlenW (lpString=".1cd") returned 4 [0261.313] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.313] lstrlenW (lpString=".jpg") returned 4 [0261.313] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.313] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.313] lstrlenW (lpString=".doc") returned 4 [0261.313] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.313] lstrlenW (lpString=".docx") returned 5 [0261.313] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.313] lstrlenW (lpString=".pdf") returned 4 [0261.313] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.313] lstrlenW (lpString=".xls") returned 4 [0261.313] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.313] lstrlenW (lpString=".xlsx") returned 5 [0261.313] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.313] lstrlenW (lpString=".ppt") returned 4 [0261.313] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.314] lstrlenW (lpString=".zip") returned 4 [0261.314] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.314] lstrlenW (lpString=".rar") returned 4 [0261.314] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.314] lstrlenW (lpString=".bz2") returned 4 [0261.314] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.314] lstrlenW (lpString=".7z") returned 3 [0261.314] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.314] lstrlenW (lpString=".dbf") returned 4 [0261.314] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.314] lstrlenW (lpString=".1cd") returned 4 [0261.314] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.314] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0261.314] lstrlenW (lpString=".jpg") returned 4 [0261.314] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.314] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.315] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.315] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0261.315] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=91712) returned 1 [0261.315] CloseHandle (hObject=0x168) returned 1 [0261.315] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0261.315] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.315] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.315] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.315] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.315] lstrlenW (lpString=".doc") returned 4 [0261.316] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.316] lstrlenW (lpString=".docx") returned 5 [0261.316] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.316] lstrlenW (lpString=".pdf") returned 4 [0261.316] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.316] lstrlenW (lpString=".xls") returned 4 [0261.316] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.316] lstrlenW (lpString=".xlsx") returned 5 [0261.316] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.316] lstrlenW (lpString=".ppt") returned 4 [0261.316] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.316] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.316] lstrlenW (lpString=".zip") returned 4 [0261.316] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.316] lstrlenW (lpString=".rar") returned 4 [0261.316] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.316] lstrlenW (lpString=".bz2") returned 4 [0261.316] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.316] lstrlenW (lpString=".7z") returned 3 [0261.317] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.317] lstrlenW (lpString=".dbf") returned 4 [0261.317] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.317] lstrlenW (lpString=".1cd") returned 4 [0261.317] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.317] lstrlenW (lpString=".jpg") returned 4 [0261.317] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.317] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.317] lstrlenW (lpString=".doc") returned 4 [0261.317] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.317] lstrlenW (lpString=".docx") returned 5 [0261.317] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.318] lstrlenW (lpString=".pdf") returned 4 [0261.318] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.318] lstrlenW (lpString=".xls") returned 4 [0261.318] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.318] lstrlenW (lpString=".xlsx") returned 5 [0261.318] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.318] lstrlenW (lpString=".ppt") returned 4 [0261.318] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.318] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.318] lstrlenW (lpString=".zip") returned 4 [0261.318] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.318] lstrlenW (lpString=".rar") returned 4 [0261.318] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.318] lstrlenW (lpString=".bz2") returned 4 [0261.318] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.318] lstrlenW (lpString=".7z") returned 3 [0261.318] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.318] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.318] lstrlenW (lpString=".dbf") returned 4 [0261.318] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.318] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.318] lstrlenW (lpString=".1cd") returned 4 [0261.318] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.318] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0261.318] lstrlenW (lpString=".jpg") returned 4 [0261.318] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.319] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.319] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.319] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0261.319] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=94800) returned 1 [0261.319] CloseHandle (hObject=0x168) returned 1 [0261.319] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0261.319] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.319] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.320] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.320] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.320] lstrlenW (lpString=".doc") returned 4 [0261.320] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.320] lstrlenW (lpString=".docx") returned 5 [0261.320] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.320] lstrlenW (lpString=".pdf") returned 4 [0261.320] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.320] lstrlenW (lpString=".xls") returned 4 [0261.320] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.320] lstrlenW (lpString=".xlsx") returned 5 [0261.320] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.320] lstrlenW (lpString=".ppt") returned 4 [0261.320] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.320] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.320] lstrlenW (lpString=".zip") returned 4 [0261.320] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.320] lstrlenW (lpString=".rar") returned 4 [0261.320] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.320] lstrlenW (lpString=".bz2") returned 4 [0261.320] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.320] lstrlenW (lpString=".7z") returned 3 [0261.320] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.320] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.320] lstrlenW (lpString=".dbf") returned 4 [0261.320] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.321] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.321] lstrlenW (lpString=".1cd") returned 4 [0261.321] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.321] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.321] lstrlenW (lpString=".jpg") returned 4 [0261.321] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.321] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.321] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.321] lstrlenW (lpString=".doc") returned 4 [0261.321] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.321] lstrlenW (lpString=".docx") returned 5 [0261.321] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.321] lstrlenW (lpString=".pdf") returned 4 [0261.321] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.321] lstrlenW (lpString=".xls") returned 4 [0261.321] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.321] lstrlenW (lpString=".xlsx") returned 5 [0261.321] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.321] lstrlenW (lpString=".ppt") returned 4 [0261.321] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.321] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.321] lstrlenW (lpString=".zip") returned 4 [0261.321] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.321] lstrlenW (lpString=".rar") returned 4 [0261.321] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.321] lstrlenW (lpString=".bz2") returned 4 [0261.322] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.322] lstrlenW (lpString=".7z") returned 3 [0261.322] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.322] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.322] lstrlenW (lpString=".dbf") returned 4 [0261.322] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0261.322] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.322] lstrlenW (lpString=".1cd") returned 4 [0261.322] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0261.322] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0261.322] lstrlenW (lpString=".jpg") returned 4 [0261.322] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0261.322] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0261.322] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0261.322] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0261.322] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=85056) returned 1 [0261.322] CloseHandle (hObject=0x168) returned 1 [0261.323] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0261.323] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.323] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.323] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0261.323] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0261.323] lstrlenW (lpString=".doc") returned 4 [0261.323] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0261.323] lstrlenW (lpString=".docx") returned 5 [0261.323] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0261.323] lstrlenW (lpString=".pdf") returned 4 [0261.323] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0261.323] lstrlenW (lpString=".xls") returned 4 [0261.323] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0261.323] lstrlenW (lpString=".xlsx") returned 5 [0261.323] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0261.323] lstrlenW (lpString=".ppt") returned 4 [0261.323] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0261.323] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0261.323] lstrlenW (lpString=".zip") returned 4 [0261.323] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0261.323] lstrlenW (lpString=".rar") returned 4 [0261.323] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0261.323] lstrlenW (lpString=".bz2") returned 4 [0261.324] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0261.324] lstrlenW (lpString=".7z") returned 3 [0261.324] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0261.326] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=43600) returned 1 [0261.326] CloseHandle (hObject=0x168) returned 1 [0261.326] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0261.326] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.326] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.326] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=90192) returned 1 [0261.326] CloseHandle (hObject=0x168) returned 1 [0261.326] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0261.327] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.327] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.327] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=89152) returned 1 [0261.327] CloseHandle (hObject=0x168) returned 1 [0261.327] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0261.327] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.327] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.328] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3694080) returned 1 [0261.328] CloseHandle (hObject=0x168) returned 1 [0261.328] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0261.328] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.328] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0261.330] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3876772) returned 1 [0261.330] CloseHandle (hObject=0x168) returned 1 [0261.330] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0261.330] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.330] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0261.331] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1984228) returned 1 [0261.331] CloseHandle (hObject=0x168) returned 1 [0261.331] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0261.331] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.331] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0261.331] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2371360) returned 1 [0261.331] CloseHandle (hObject=0x168) returned 1 [0261.332] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0261.332] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.332] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0261.332] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=47452) returned 1 [0261.332] CloseHandle (hObject=0x168) returned 1 [0261.332] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0261.332] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.332] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.333] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=93248) returned 1 [0261.333] CloseHandle (hObject=0x168) returned 1 [0261.333] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0261.333] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.333] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.333] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=90688) returned 1 [0261.333] CloseHandle (hObject=0x168) returned 1 [0261.333] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0261.333] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.333] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.334] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=90704) returned 1 [0261.334] CloseHandle (hObject=0x168) returned 1 [0261.334] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0261.334] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.334] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.334] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=76352) returned 1 [0261.334] CloseHandle (hObject=0x168) returned 1 [0261.334] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0261.334] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.585] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.591] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0261.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0261.592] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0261.592] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0261.592] ReadFile (in: hFile=0x178, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.623] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0261.623] ReadFile (in: hFile=0x178, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.647] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0261.647] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0261.648] ReadFile (in: hFile=0x178, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.785] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.785] WriteFile (in: hFile=0x178, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0261.875] SetEndOfFile (hFile=0x178) returned 1 [0262.089] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0262.099] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0262.099] WriteFile (in: hFile=0x178, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.101] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0262.101] WriteFile (in: hFile=0x178, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.188] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0262.188] WriteFile (in: hFile=0x178, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.191] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0262.194] CloseHandle (hObject=0x178) returned 1 [0262.952] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.952] lstrlenW (lpString=".doc") returned 4 [0262.952] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0262.952] lstrlenW (lpString=".docx") returned 5 [0262.952] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0262.952] lstrlenW (lpString=".pdf") returned 4 [0262.952] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0262.952] lstrlenW (lpString=".xls") returned 4 [0262.952] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0262.952] lstrlenW (lpString=".xlsx") returned 5 [0262.952] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0262.952] lstrlenW (lpString=".ppt") returned 4 [0262.952] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0262.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.952] lstrlenW (lpString=".zip") returned 4 [0262.952] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0262.953] lstrlenW (lpString=".rar") returned 4 [0262.953] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0262.953] lstrlenW (lpString=".bz2") returned 4 [0262.953] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0262.953] lstrlenW (lpString=".7z") returned 3 [0262.953] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0262.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.953] lstrlenW (lpString=".dbf") returned 4 [0262.953] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0262.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.953] lstrlenW (lpString=".1cd") returned 4 [0262.953] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0262.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.953] lstrlenW (lpString=".jpg") returned 4 [0262.953] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0262.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.953] lstrlenW (lpString=".doc") returned 4 [0262.953] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0262.953] lstrlenW (lpString=".docx") returned 5 [0262.953] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0262.953] lstrlenW (lpString=".pdf") returned 4 [0262.953] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0262.953] lstrlenW (lpString=".xls") returned 4 [0262.953] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0262.953] lstrlenW (lpString=".xlsx") returned 5 [0262.954] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0262.954] lstrlenW (lpString=".ppt") returned 4 [0262.954] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0262.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.954] lstrlenW (lpString=".zip") returned 4 [0262.954] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0262.954] lstrlenW (lpString=".rar") returned 4 [0262.954] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0262.954] lstrlenW (lpString=".bz2") returned 4 [0262.954] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0262.954] lstrlenW (lpString=".7z") returned 3 [0262.954] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0262.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.954] lstrlenW (lpString=".dbf") returned 4 [0262.954] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0262.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.954] lstrlenW (lpString=".1cd") returned 4 [0262.954] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0262.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0262.954] lstrlenW (lpString=".jpg") returned 4 [0262.954] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0262.989] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0262.989] lstrlenW (lpString="PubLR.cab") returned 9 [0262.989] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0262.989] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=9958388) returned 1 [0262.989] CloseHandle (hObject=0x178) returned 1 [0262.989] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0262.989] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.989] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0262.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0262.990] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0262.990] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0262.990] ReadFile (in: hFile=0x178, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0263.004] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0263.004] ReadFile (in: hFile=0x178, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0263.030] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0263.030] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0263.030] ReadFile (in: hFile=0x178, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0263.226] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0263.227] WriteFile (in: hFile=0x178, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0263.244] SetEndOfFile (hFile=0x178) returned 1 [0263.245] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f33888 [0263.245] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0263.245] WriteFile (in: hFile=0x178, lpBuffer=0x3f33888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33888*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.246] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0263.246] WriteFile (in: hFile=0x178, lpBuffer=0x3f33888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33888*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.251] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0263.252] WriteFile (in: hFile=0x178, lpBuffer=0x3f33888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33888*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.433] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f33888 | out: hHeap=0x2e0000) returned 1 [0263.434] CloseHandle (hObject=0x178) returned 1 [0266.748] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0266.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.749] lstrlenW (lpString=".doc") returned 4 [0266.749] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0266.749] lstrlenW (lpString=".docx") returned 5 [0266.749] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0266.749] lstrlenW (lpString=".pdf") returned 4 [0266.749] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0266.749] lstrlenW (lpString=".xls") returned 4 [0266.749] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0266.749] lstrlenW (lpString=".xlsx") returned 5 [0266.749] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0266.749] lstrlenW (lpString=".ppt") returned 4 [0266.749] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0266.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.749] lstrlenW (lpString=".zip") returned 4 [0266.749] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0266.749] lstrlenW (lpString=".rar") returned 4 [0266.749] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0266.749] lstrlenW (lpString=".bz2") returned 4 [0266.750] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0266.750] lstrlenW (lpString=".7z") returned 3 [0266.750] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0266.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.750] lstrlenW (lpString=".dbf") returned 4 [0266.750] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0266.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.750] lstrlenW (lpString=".1cd") returned 4 [0266.750] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0266.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.750] lstrlenW (lpString=".jpg") returned 4 [0266.750] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0266.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.750] lstrlenW (lpString=".doc") returned 4 [0266.750] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0266.750] lstrlenW (lpString=".docx") returned 5 [0266.750] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0266.750] lstrlenW (lpString=".pdf") returned 4 [0266.750] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0266.750] lstrlenW (lpString=".xls") returned 4 [0266.750] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0266.750] lstrlenW (lpString=".xlsx") returned 5 [0266.751] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0266.751] lstrlenW (lpString=".ppt") returned 4 [0266.751] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0266.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.751] lstrlenW (lpString=".zip") returned 4 [0266.751] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0266.751] lstrlenW (lpString=".rar") returned 4 [0266.751] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0266.751] lstrlenW (lpString=".bz2") returned 4 [0266.751] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0266.751] lstrlenW (lpString=".7z") returned 3 [0266.751] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0266.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.751] lstrlenW (lpString=".dbf") returned 4 [0266.751] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0266.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.751] lstrlenW (lpString=".1cd") returned 4 [0266.751] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0266.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0266.751] lstrlenW (lpString=".jpg") returned 4 [0266.751] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0266.751] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0266.751] lstrlenW (lpString="WordLR.cab") returned 10 [0266.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.792] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=43806141) returned 1 [0266.792] CloseHandle (hObject=0x1c4) returned 1 [0266.792] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0266.792] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.793] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0266.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0266.793] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0266.793] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0266.793] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0266.886] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0266.886] ReadFile (in: hFile=0x1c4, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0266.904] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0266.905] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0266.905] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0267.020] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0267.020] WriteFile (in: hFile=0x1c4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0267.424] SetEndOfFile (hFile=0x1c4) returned 1 [0267.424] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f948c8 [0267.428] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0267.428] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f948c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f948c8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.429] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0267.429] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f948c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f948c8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.431] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0267.431] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f948c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f948c8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.438] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.438] CloseHandle (hObject=0x1c4) returned 1 [0269.799] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0269.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.800] lstrlenW (lpString=".doc") returned 4 [0269.800] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0269.800] lstrlenW (lpString=".docx") returned 5 [0269.800] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0269.800] lstrlenW (lpString=".pdf") returned 4 [0269.800] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0269.800] lstrlenW (lpString=".xls") returned 4 [0269.800] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0269.800] lstrlenW (lpString=".xlsx") returned 5 [0269.800] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0269.800] lstrlenW (lpString=".ppt") returned 4 [0269.800] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0269.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.800] lstrlenW (lpString=".zip") returned 4 [0269.800] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0269.800] lstrlenW (lpString=".rar") returned 4 [0269.800] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0269.800] lstrlenW (lpString=".bz2") returned 4 [0269.800] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0269.800] lstrlenW (lpString=".7z") returned 3 [0269.800] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0269.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.800] lstrlenW (lpString=".dbf") returned 4 [0269.801] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.801] lstrlenW (lpString=".1cd") returned 4 [0269.801] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0269.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.801] lstrlenW (lpString=".jpg") returned 4 [0269.801] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.801] lstrlenW (lpString=".doc") returned 4 [0269.801] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString=".docx") returned 5 [0269.801] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0269.801] lstrlenW (lpString=".pdf") returned 4 [0269.801] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString=".xls") returned 4 [0269.801] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString=".xlsx") returned 5 [0269.801] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0269.801] lstrlenW (lpString=".ppt") returned 4 [0269.801] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.801] lstrlenW (lpString=".zip") returned 4 [0269.801] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString=".rar") returned 4 [0269.801] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0269.801] lstrlenW (lpString=".bz2") returned 4 [0269.801] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0269.801] lstrlenW (lpString=".7z") returned 3 [0269.801] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0269.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.802] lstrlenW (lpString=".dbf") returned 4 [0269.802] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0269.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.802] lstrlenW (lpString=".1cd") returned 4 [0269.802] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0269.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0269.802] lstrlenW (lpString=".jpg") returned 4 [0269.802] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0269.802] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0269.802] lstrlenW (lpString="Proof.msi") returned 9 [0269.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0269.802] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=885760) returned 1 [0269.802] CloseHandle (hObject=0x1c4) returned 1 [0269.802] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0269.802] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0269.803] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0269.803] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0269.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0269.803] GetLastError () returned 0x0 [0269.803] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xd8400, lpOverlapped=0x0) returned 1 [0269.882] WriteFile (in: hFile=0x174, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0269.898] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0269.898] WriteFile (in: hFile=0x174, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0269.898] SetEndOfFile (hFile=0x174) returned 1 [0269.898] CloseHandle (hObject=0x174) returned 1 [0270.101] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.101] SetEndOfFile (hFile=0x1c4) returned 1 [0270.243] CloseHandle (hObject=0x1c4) returned 1 [0270.243] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0270.243] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0270.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString=".doc") returned 4 [0270.244] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0270.244] lstrlenW (lpString=".docx") returned 5 [0270.244] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0270.244] lstrlenW (lpString=".pdf") returned 4 [0270.244] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0270.244] lstrlenW (lpString=".xls") returned 4 [0270.244] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0270.244] lstrlenW (lpString=".xlsx") returned 5 [0270.244] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0270.244] lstrlenW (lpString=".ppt") returned 4 [0270.244] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0270.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString=".zip") returned 4 [0270.244] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0270.244] lstrlenW (lpString=".rar") returned 4 [0270.244] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0270.244] lstrlenW (lpString=".bz2") returned 4 [0270.244] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0270.244] lstrlenW (lpString=".7z") returned 3 [0270.244] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0270.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString=".dbf") returned 4 [0270.244] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0270.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString=".1cd") returned 4 [0270.244] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0270.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString=".jpg") returned 4 [0270.244] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0270.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.244] lstrlenW (lpString=".doc") returned 4 [0270.245] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0270.245] lstrlenW (lpString=".docx") returned 5 [0270.245] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0270.245] lstrlenW (lpString=".pdf") returned 4 [0270.245] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0270.245] lstrlenW (lpString=".xls") returned 4 [0270.245] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0270.245] lstrlenW (lpString=".xlsx") returned 5 [0270.245] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0270.245] lstrlenW (lpString=".ppt") returned 4 [0270.245] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0270.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.245] lstrlenW (lpString=".zip") returned 4 [0270.245] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0270.245] lstrlenW (lpString=".rar") returned 4 [0270.245] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0270.245] lstrlenW (lpString=".bz2") returned 4 [0270.245] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0270.245] lstrlenW (lpString=".7z") returned 3 [0270.245] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0270.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.245] lstrlenW (lpString=".dbf") returned 4 [0270.245] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0270.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.245] lstrlenW (lpString=".1cd") returned 4 [0270.245] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0270.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0270.245] lstrlenW (lpString=".jpg") returned 4 [0270.245] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0270.245] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0270.245] lstrlenW (lpString="Proofing.msi") returned 12 [0270.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0270.246] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=868864) returned 1 [0270.246] CloseHandle (hObject=0x1c4) returned 1 [0270.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0270.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0270.246] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.246] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.247] GetLastError () returned 0x0 [0270.247] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0270.313] WriteFile (in: hFile=0x174, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0270.527] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0270.527] WriteFile (in: hFile=0x174, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.527] SetEndOfFile (hFile=0x174) returned 1 [0270.527] CloseHandle (hObject=0x174) returned 1 [0270.534] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.534] SetEndOfFile (hFile=0x1c4) returned 1 [0270.540] CloseHandle (hObject=0x1c4) returned 1 [0270.540] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0270.541] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0270.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.541] lstrlenW (lpString=".doc") returned 4 [0270.541] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0270.541] lstrlenW (lpString=".docx") returned 5 [0270.541] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0270.542] lstrlenW (lpString=".pdf") returned 4 [0270.542] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0270.542] lstrlenW (lpString=".xls") returned 4 [0270.542] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0270.542] lstrlenW (lpString=".xlsx") returned 5 [0270.542] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0270.542] lstrlenW (lpString=".ppt") returned 4 [0270.542] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0270.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.542] lstrlenW (lpString=".zip") returned 4 [0270.542] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0270.542] lstrlenW (lpString=".rar") returned 4 [0270.542] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0270.542] lstrlenW (lpString=".bz2") returned 4 [0270.542] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0270.542] lstrlenW (lpString=".7z") returned 3 [0270.542] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0270.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.542] lstrlenW (lpString=".dbf") returned 4 [0270.542] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0270.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.542] lstrlenW (lpString=".1cd") returned 4 [0270.542] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0270.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.543] lstrlenW (lpString=".jpg") returned 4 [0270.543] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0270.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.543] lstrlenW (lpString=".doc") returned 4 [0270.543] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0270.543] lstrlenW (lpString=".docx") returned 5 [0270.543] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0270.543] lstrlenW (lpString=".pdf") returned 4 [0270.543] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0270.543] lstrlenW (lpString=".xls") returned 4 [0270.543] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0270.543] lstrlenW (lpString=".xlsx") returned 5 [0270.543] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0270.543] lstrlenW (lpString=".ppt") returned 4 [0270.543] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0270.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.543] lstrlenW (lpString=".zip") returned 4 [0270.543] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0270.543] lstrlenW (lpString=".rar") returned 4 [0270.543] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0270.543] lstrlenW (lpString=".bz2") returned 4 [0270.543] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0270.543] lstrlenW (lpString=".7z") returned 3 [0270.544] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0270.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.544] lstrlenW (lpString=".dbf") returned 4 [0270.544] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0270.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.544] lstrlenW (lpString=".1cd") returned 4 [0270.544] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0270.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0270.544] lstrlenW (lpString=".jpg") returned 4 [0270.544] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0270.544] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0270.544] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0270.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0270.544] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2928955) returned 1 [0270.544] CloseHandle (hObject=0x1c4) returned 1 [0270.545] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0270.545] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.545] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0270.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0270.546] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0270.546] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0270.546] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0270.783] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0270.783] ReadFile (in: hFile=0x1c4, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0270.990] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0270.990] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0270.990] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.068] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0271.068] WriteFile (in: hFile=0x1c4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0271.084] SetEndOfFile (hFile=0x1c4) returned 1 [0271.084] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0271.084] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0271.084] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.351] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0271.351] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.357] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0271.357] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.359] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0271.359] CloseHandle (hObject=0x1c4) returned 1 [0271.858] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0271.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.859] lstrlenW (lpString=".doc") returned 4 [0271.859] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString=".docx") returned 5 [0271.859] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0271.859] lstrlenW (lpString=".pdf") returned 4 [0271.859] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString=".xls") returned 4 [0271.859] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString=".xlsx") returned 5 [0271.859] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0271.859] lstrlenW (lpString=".ppt") returned 4 [0271.859] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.859] lstrlenW (lpString=".zip") returned 4 [0271.859] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString=".rar") returned 4 [0271.859] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString=".bz2") returned 4 [0271.859] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0271.859] lstrlenW (lpString=".7z") returned 3 [0271.859] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0271.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.859] lstrlenW (lpString=".dbf") returned 4 [0271.859] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0271.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.859] lstrlenW (lpString=".1cd") returned 4 [0271.859] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0271.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.859] lstrlenW (lpString=".jpg") returned 4 [0271.859] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.860] lstrlenW (lpString=".doc") returned 4 [0271.860] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString=".docx") returned 5 [0271.860] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0271.860] lstrlenW (lpString=".pdf") returned 4 [0271.860] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString=".xls") returned 4 [0271.860] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString=".xlsx") returned 5 [0271.860] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0271.860] lstrlenW (lpString=".ppt") returned 4 [0271.860] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.860] lstrlenW (lpString=".zip") returned 4 [0271.860] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString=".rar") returned 4 [0271.860] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString=".bz2") returned 4 [0271.860] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0271.860] lstrlenW (lpString=".7z") returned 3 [0271.860] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0271.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.860] lstrlenW (lpString=".dbf") returned 4 [0271.860] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0271.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.860] lstrlenW (lpString=".1cd") returned 4 [0271.860] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0271.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0271.860] lstrlenW (lpString=".jpg") returned 4 [0271.861] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0271.861] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0271.861] lstrlenW (lpString="OnoteLR.cab") returned 11 [0271.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0271.866] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=17456632) returned 1 [0271.866] CloseHandle (hObject=0x1f4) returned 1 [0271.866] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0271.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.867] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0271.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0271.867] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0271.867] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0271.867] ReadFile (in: hFile=0x1f4, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.908] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0271.908] ReadFile (in: hFile=0x1f4, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.042] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0272.042] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0272.042] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.397] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0272.397] WriteFile (in: hFile=0x1f4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0272.415] SetEndOfFile (hFile=0x1f4) returned 1 [0272.415] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0272.418] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0272.418] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0272.419] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0272.419] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0272.420] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0272.420] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0272.422] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0272.422] CloseHandle (hObject=0x1f4) returned 1 [0272.422] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0272.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.422] lstrlenW (lpString=".doc") returned 4 [0272.422] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0272.422] lstrlenW (lpString=".docx") returned 5 [0272.422] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0272.422] lstrlenW (lpString=".pdf") returned 4 [0272.423] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".xls") returned 4 [0272.423] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".xlsx") returned 5 [0272.423] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0272.423] lstrlenW (lpString=".ppt") returned 4 [0272.423] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.423] lstrlenW (lpString=".zip") returned 4 [0272.423] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".rar") returned 4 [0272.423] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".bz2") returned 4 [0272.423] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0272.423] lstrlenW (lpString=".7z") returned 3 [0272.423] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0272.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.423] lstrlenW (lpString=".dbf") returned 4 [0272.423] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.423] lstrlenW (lpString=".1cd") returned 4 [0272.423] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0272.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.423] lstrlenW (lpString=".jpg") returned 4 [0272.423] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.423] lstrlenW (lpString=".doc") returned 4 [0272.423] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".docx") returned 5 [0272.423] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0272.423] lstrlenW (lpString=".pdf") returned 4 [0272.423] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".xls") returned 4 [0272.423] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0272.423] lstrlenW (lpString=".xlsx") returned 5 [0272.423] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0272.424] lstrlenW (lpString=".ppt") returned 4 [0272.424] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0272.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.424] lstrlenW (lpString=".zip") returned 4 [0272.424] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0272.424] lstrlenW (lpString=".rar") returned 4 [0272.424] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0272.424] lstrlenW (lpString=".bz2") returned 4 [0272.424] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0272.424] lstrlenW (lpString=".7z") returned 3 [0272.424] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0272.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.424] lstrlenW (lpString=".dbf") returned 4 [0272.424] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0272.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.424] lstrlenW (lpString=".1cd") returned 4 [0272.424] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0272.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0272.424] lstrlenW (lpString=".jpg") returned 4 [0272.424] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0272.424] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0272.424] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0272.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0272.515] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2511872) returned 1 [0272.515] CloseHandle (hObject=0x1f4) returned 1 [0272.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0272.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0272.515] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0272.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0272.516] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0272.516] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0272.516] ReadFile (in: hFile=0x1f4, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.638] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0272.638] ReadFile (in: hFile=0x1f4, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0276.905] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0276.905] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0276.905] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0277.051] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0277.051] WriteFile (in: hFile=0x1f4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0277.073] SetEndOfFile (hFile=0x1f4) returned 1 [0277.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0277.813] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0277.813] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.037] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.047] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.047] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.052] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0278.052] CloseHandle (hObject=0x1f4) returned 1 [0278.052] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.052] lstrlenW (lpString=".doc") returned 4 [0278.052] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0278.052] lstrlenW (lpString=".docx") returned 5 [0278.052] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0278.052] lstrlenW (lpString=".pdf") returned 4 [0278.052] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0278.052] lstrlenW (lpString=".xls") returned 4 [0278.052] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0278.052] lstrlenW (lpString=".xlsx") returned 5 [0278.053] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0278.053] lstrlenW (lpString=".ppt") returned 4 [0278.053] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0278.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.053] lstrlenW (lpString=".zip") returned 4 [0278.053] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0278.053] lstrlenW (lpString=".rar") returned 4 [0278.053] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0278.053] lstrlenW (lpString=".bz2") returned 4 [0278.053] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0278.053] lstrlenW (lpString=".7z") returned 3 [0278.053] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0278.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.053] lstrlenW (lpString=".dbf") returned 4 [0278.053] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0278.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.053] lstrlenW (lpString=".1cd") returned 4 [0278.053] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0278.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.053] lstrlenW (lpString=".jpg") returned 4 [0278.053] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0278.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.053] lstrlenW (lpString=".doc") returned 4 [0278.053] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0278.053] lstrlenW (lpString=".docx") returned 5 [0278.053] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0278.053] lstrlenW (lpString=".pdf") returned 4 [0278.053] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0278.054] lstrlenW (lpString=".xls") returned 4 [0278.054] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0278.054] lstrlenW (lpString=".xlsx") returned 5 [0278.054] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0278.054] lstrlenW (lpString=".ppt") returned 4 [0278.054] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0278.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.054] lstrlenW (lpString=".zip") returned 4 [0278.054] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0278.054] lstrlenW (lpString=".rar") returned 4 [0278.054] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0278.054] lstrlenW (lpString=".bz2") returned 4 [0278.054] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0278.054] lstrlenW (lpString=".7z") returned 3 [0278.054] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0278.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.054] lstrlenW (lpString=".dbf") returned 4 [0278.054] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0278.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.054] lstrlenW (lpString=".1cd") returned 4 [0278.054] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0278.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0278.054] lstrlenW (lpString=".jpg") returned 4 [0278.054] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0278.054] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0278.055] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0278.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0278.055] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3702272) returned 1 [0278.055] CloseHandle (hObject=0x1f4) returned 1 [0278.055] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0278.055] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.055] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0278.056] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0278.056] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0278.056] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.056] ReadFile (in: hFile=0x1f4, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0278.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.087] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.288] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.289] WriteFile (in: hFile=0x1f4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0278.513] SetEndOfFile (hFile=0x1f4) returned 1 [0278.513] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0278.527] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.528] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.529] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.529] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.534] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.534] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.537] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0278.537] CloseHandle (hObject=0x1f4) returned 1 [0278.537] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.538] lstrlenW (lpString=".doc") returned 4 [0278.538] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0278.538] lstrlenW (lpString=".docx") returned 5 [0278.538] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0278.538] lstrlenW (lpString=".pdf") returned 4 [0278.538] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0278.538] lstrlenW (lpString=".xls") returned 4 [0278.538] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0278.538] lstrlenW (lpString=".xlsx") returned 5 [0278.538] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0278.538] lstrlenW (lpString=".ppt") returned 4 [0278.538] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0278.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.538] lstrlenW (lpString=".zip") returned 4 [0278.538] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0278.538] lstrlenW (lpString=".rar") returned 4 [0278.538] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0278.538] lstrlenW (lpString=".bz2") returned 4 [0278.538] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0278.538] lstrlenW (lpString=".7z") returned 3 [0278.539] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0278.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.539] lstrlenW (lpString=".dbf") returned 4 [0278.539] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0278.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.539] lstrlenW (lpString=".1cd") returned 4 [0278.539] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0278.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.539] lstrlenW (lpString=".jpg") returned 4 [0278.539] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0278.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.539] lstrlenW (lpString=".doc") returned 4 [0278.539] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0278.539] lstrlenW (lpString=".docx") returned 5 [0278.539] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0278.539] lstrlenW (lpString=".pdf") returned 4 [0278.539] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0278.539] lstrlenW (lpString=".xls") returned 4 [0278.539] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0278.539] lstrlenW (lpString=".xlsx") returned 5 [0278.539] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0278.539] lstrlenW (lpString=".ppt") returned 4 [0278.539] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0278.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.540] lstrlenW (lpString=".zip") returned 4 [0278.540] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0278.540] lstrlenW (lpString=".rar") returned 4 [0278.540] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0278.540] lstrlenW (lpString=".bz2") returned 4 [0278.540] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0278.540] lstrlenW (lpString=".7z") returned 3 [0278.540] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0278.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.540] lstrlenW (lpString=".dbf") returned 4 [0278.540] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0278.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.540] lstrlenW (lpString=".1cd") returned 4 [0278.540] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0278.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0278.540] lstrlenW (lpString=".jpg") returned 4 [0278.540] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0278.540] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0278.540] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0278.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0278.541] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=868864) returned 1 [0278.541] CloseHandle (hObject=0x1f4) returned 1 [0278.541] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0278.541] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0278.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.870] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0278.870] GetLastError () returned 0x0 [0278.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0279.032] WriteFile (in: hFile=0x1f4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0279.089] ReadFile (in: hFile=0x1b0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0279.089] WriteFile (in: hFile=0x1f4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0279.089] SetEndOfFile (hFile=0x1f4) returned 1 [0279.089] CloseHandle (hObject=0x1f4) returned 1 [0279.089] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0279.089] SetEndOfFile (hFile=0x1b0) returned 1 [0279.097] CloseHandle (hObject=0x1b0) returned 1 [0279.097] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.097] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0279.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.097] lstrlenW (lpString=".doc") returned 4 [0279.097] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.097] lstrlenW (lpString=".docx") returned 5 [0279.097] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0279.097] lstrlenW (lpString=".pdf") returned 4 [0279.097] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.098] lstrlenW (lpString=".xls") returned 4 [0279.098] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.098] lstrlenW (lpString=".xlsx") returned 5 [0279.098] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0279.098] lstrlenW (lpString=".ppt") returned 4 [0279.098] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.098] lstrlenW (lpString=".zip") returned 4 [0279.098] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.098] lstrlenW (lpString=".rar") returned 4 [0279.098] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.098] lstrlenW (lpString=".bz2") returned 4 [0279.098] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.098] lstrlenW (lpString=".7z") returned 3 [0279.098] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.098] lstrlenW (lpString=".dbf") returned 4 [0279.098] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.098] lstrlenW (lpString=".1cd") returned 4 [0279.098] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.098] lstrlenW (lpString=".jpg") returned 4 [0279.098] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.098] lstrlenW (lpString=".doc") returned 4 [0279.098] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.098] lstrlenW (lpString=".docx") returned 5 [0279.098] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0279.098] lstrlenW (lpString=".pdf") returned 4 [0279.098] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.098] lstrlenW (lpString=".xls") returned 4 [0279.099] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.099] lstrlenW (lpString=".xlsx") returned 5 [0279.099] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0279.099] lstrlenW (lpString=".ppt") returned 4 [0279.099] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.099] lstrlenW (lpString=".zip") returned 4 [0279.099] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.099] lstrlenW (lpString=".rar") returned 4 [0279.099] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.099] lstrlenW (lpString=".bz2") returned 4 [0279.099] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.099] lstrlenW (lpString=".7z") returned 3 [0279.099] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.099] lstrlenW (lpString=".dbf") returned 4 [0279.099] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.099] lstrlenW (lpString=".1cd") returned 4 [0279.099] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0279.099] lstrlenW (lpString=".jpg") returned 4 [0279.099] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.099] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0279.100] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0279.100] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0279.100] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=36233052) returned 1 [0279.100] CloseHandle (hObject=0x1b0) returned 1 [0279.100] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0279.100] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.100] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0279.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0279.163] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0279.164] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.164] ReadFile (in: hFile=0x1b0, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.201] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.202] ReadFile (in: hFile=0x1b0, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0279.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.230] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.277] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0279.277] WriteFile (in: hFile=0x1b0, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0279.566] SetEndOfFile (hFile=0x1b0) returned 1 [0279.566] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0279.571] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.571] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.572] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.572] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.573] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.573] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.576] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0279.579] CloseHandle (hObject=0x1b0) returned 1 [0279.580] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.580] lstrlenW (lpString=".doc") returned 4 [0279.580] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0279.580] lstrlenW (lpString=".docx") returned 5 [0279.580] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0279.580] lstrlenW (lpString=".pdf") returned 4 [0279.580] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0279.580] lstrlenW (lpString=".xls") returned 4 [0279.580] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0279.580] lstrlenW (lpString=".xlsx") returned 5 [0279.580] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0279.580] lstrlenW (lpString=".ppt") returned 4 [0279.580] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0279.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.580] lstrlenW (lpString=".zip") returned 4 [0279.581] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0279.581] lstrlenW (lpString=".rar") returned 4 [0279.581] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0279.581] lstrlenW (lpString=".bz2") returned 4 [0279.581] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0279.581] lstrlenW (lpString=".7z") returned 3 [0279.581] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0279.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.581] lstrlenW (lpString=".dbf") returned 4 [0279.581] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0279.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.581] lstrlenW (lpString=".1cd") returned 4 [0279.581] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0279.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.581] lstrlenW (lpString=".jpg") returned 4 [0279.581] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0279.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.581] lstrlenW (lpString=".doc") returned 4 [0279.581] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0279.581] lstrlenW (lpString=".docx") returned 5 [0279.581] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0279.581] lstrlenW (lpString=".pdf") returned 4 [0279.581] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0279.582] lstrlenW (lpString=".xls") returned 4 [0279.582] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0279.582] lstrlenW (lpString=".xlsx") returned 5 [0279.582] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0279.582] lstrlenW (lpString=".ppt") returned 4 [0279.582] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0279.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.582] lstrlenW (lpString=".zip") returned 4 [0279.582] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0279.582] lstrlenW (lpString=".rar") returned 4 [0279.582] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0279.582] lstrlenW (lpString=".bz2") returned 4 [0279.582] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0279.582] lstrlenW (lpString=".7z") returned 3 [0279.582] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0279.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.582] lstrlenW (lpString=".dbf") returned 4 [0279.582] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0279.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.582] lstrlenW (lpString=".1cd") returned 4 [0279.582] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0279.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0279.582] lstrlenW (lpString=".jpg") returned 4 [0279.582] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0279.583] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0279.583] lstrlenW (lpString="ProPrWW.cab") returned 11 [0279.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0279.708] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=177720283) returned 1 [0279.708] CloseHandle (hObject=0x210) returned 1 [0279.708] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0279.708] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.708] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0279.709] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0279.709] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0279.709] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.709] ReadFile (in: hFile=0x210, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.340] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0281.341] ReadFile (in: hFile=0x210, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.437] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0281.437] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0281.437] ReadFile (in: hFile=0x210, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.562] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0281.562] WriteFile (in: hFile=0x210, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0281.803] SetEndOfFile (hFile=0x210) returned 1 [0281.803] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0281.803] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0281.803] WriteFile (in: hFile=0x210, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0281.804] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0281.804] WriteFile (in: hFile=0x210, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0281.805] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0281.805] WriteFile (in: hFile=0x210, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0281.808] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0281.808] CloseHandle (hObject=0x210) returned 1 [0281.809] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0281.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.809] lstrlenW (lpString=".doc") returned 4 [0281.809] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0281.809] lstrlenW (lpString=".docx") returned 5 [0281.809] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0281.809] lstrlenW (lpString=".pdf") returned 4 [0281.809] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0281.809] lstrlenW (lpString=".xls") returned 4 [0281.809] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0281.809] lstrlenW (lpString=".xlsx") returned 5 [0281.810] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0281.810] lstrlenW (lpString=".ppt") returned 4 [0281.810] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0281.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.810] lstrlenW (lpString=".zip") returned 4 [0281.810] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0281.810] lstrlenW (lpString=".rar") returned 4 [0281.810] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0281.810] lstrlenW (lpString=".bz2") returned 4 [0281.810] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0281.810] lstrlenW (lpString=".7z") returned 3 [0281.810] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0281.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.810] lstrlenW (lpString=".dbf") returned 4 [0281.810] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0281.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.810] lstrlenW (lpString=".1cd") returned 4 [0281.810] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0281.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.810] lstrlenW (lpString=".jpg") returned 4 [0281.810] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.811] lstrlenW (lpString=".doc") returned 4 [0281.811] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString=".docx") returned 5 [0281.811] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0281.811] lstrlenW (lpString=".pdf") returned 4 [0281.811] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString=".xls") returned 4 [0281.811] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString=".xlsx") returned 5 [0281.811] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0281.811] lstrlenW (lpString=".ppt") returned 4 [0281.811] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.811] lstrlenW (lpString=".zip") returned 4 [0281.811] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString=".rar") returned 4 [0281.811] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0281.811] lstrlenW (lpString=".bz2") returned 4 [0281.812] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0281.812] lstrlenW (lpString=".7z") returned 3 [0281.812] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0281.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.915] lstrlenW (lpString=".dbf") returned 4 [0281.915] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0281.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.916] lstrlenW (lpString=".1cd") returned 4 [0281.916] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0281.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0281.916] lstrlenW (lpString=".jpg") returned 4 [0281.916] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0281.916] lstrcmpiW (lpString1=".xrm-ms", lpString2=".drweb") returned 1 [0281.916] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0281.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0282.035] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=715834) returned 1 [0282.035] CloseHandle (hObject=0x1f8) returned 1 [0282.035] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0282.035] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0282.035] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.035] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.052] GetLastError () returned 0x0 [0282.052] ReadFile (in: hFile=0x1f8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0282.102] WriteFile (in: hFile=0x210, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0282.119] ReadFile (in: hFile=0x1f8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0282.119] WriteFile (in: hFile=0x210, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x104, lpOverlapped=0x0) returned 1 [0282.132] SetEndOfFile (hFile=0x210) returned 1 [0282.133] CloseHandle (hObject=0x210) returned 1 [0282.133] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.133] SetEndOfFile (hFile=0x1f8) returned 1 [0282.139] CloseHandle (hObject=0x1f8) returned 1 [0282.139] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0282.139] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0282.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.139] lstrlenW (lpString=".doc") returned 4 [0282.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString=".docx") returned 5 [0282.140] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.140] lstrlenW (lpString=".pdf") returned 4 [0282.140] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString=".xls") returned 4 [0282.140] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString=".xlsx") returned 5 [0282.140] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.140] lstrlenW (lpString=".ppt") returned 4 [0282.140] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.140] lstrlenW (lpString=".zip") returned 4 [0282.140] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString=".rar") returned 4 [0282.140] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString=".bz2") returned 4 [0282.140] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString=".7z") returned 3 [0282.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.140] lstrlenW (lpString=".dbf") returned 4 [0282.140] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.140] lstrlenW (lpString=".1cd") returned 4 [0282.140] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.140] lstrlenW (lpString=".jpg") returned 4 [0282.140] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.140] lstrlenW (lpString=".doc") returned 4 [0282.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString=".docx") returned 5 [0282.141] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0282.141] lstrlenW (lpString=".pdf") returned 4 [0282.141] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString=".xls") returned 4 [0282.141] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString=".xlsx") returned 5 [0282.141] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0282.141] lstrlenW (lpString=".ppt") returned 4 [0282.141] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.141] lstrlenW (lpString=".zip") returned 4 [0282.141] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString=".rar") returned 4 [0282.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString=".bz2") returned 4 [0282.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString=".7z") returned 3 [0282.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0282.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.141] lstrlenW (lpString=".dbf") returned 4 [0282.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.141] lstrlenW (lpString=".1cd") returned 4 [0282.141] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0282.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0282.141] lstrlenW (lpString=".jpg") returned 4 [0282.141] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0282.141] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0282.141] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0282.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0282.582] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10798080) returned 1 [0282.582] CloseHandle (hObject=0x20c) returned 1 [0282.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0282.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.582] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0282.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0282.583] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0282.583] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0282.583] ReadFile (in: hFile=0x20c, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0282.694] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0282.694] ReadFile (in: hFile=0x20c, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.053] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0283.053] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.053] ReadFile (in: hFile=0x20c, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.093] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.094] WriteFile (in: hFile=0x20c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0283.172] SetEndOfFile (hFile=0x20c) returned 1 [0283.172] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0283.172] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0283.172] WriteFile (in: hFile=0x20c, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.173] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0283.173] WriteFile (in: hFile=0x20c, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.175] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0283.175] WriteFile (in: hFile=0x20c, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0283.180] CloseHandle (hObject=0x20c) returned 1 [0283.181] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.182] lstrlenW (lpString=".doc") returned 4 [0283.182] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0283.182] lstrlenW (lpString=".docx") returned 5 [0283.182] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0283.182] lstrlenW (lpString=".pdf") returned 4 [0283.182] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0283.182] lstrlenW (lpString=".xls") returned 4 [0283.182] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0283.182] lstrlenW (lpString=".xlsx") returned 5 [0283.182] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0283.182] lstrlenW (lpString=".ppt") returned 4 [0283.182] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0283.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.182] lstrlenW (lpString=".zip") returned 4 [0283.182] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0283.182] lstrlenW (lpString=".rar") returned 4 [0283.182] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0283.182] lstrlenW (lpString=".bz2") returned 4 [0283.182] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0283.182] lstrlenW (lpString=".7z") returned 3 [0283.182] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0283.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.182] lstrlenW (lpString=".dbf") returned 4 [0283.182] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0283.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.182] lstrlenW (lpString=".1cd") returned 4 [0283.182] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0283.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.183] lstrlenW (lpString=".jpg") returned 4 [0283.183] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0283.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.183] lstrlenW (lpString=".doc") returned 4 [0283.183] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0283.183] lstrlenW (lpString=".docx") returned 5 [0283.183] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0283.183] lstrlenW (lpString=".pdf") returned 4 [0283.183] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0283.183] lstrlenW (lpString=".xls") returned 4 [0283.183] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0283.183] lstrlenW (lpString=".xlsx") returned 5 [0283.183] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0283.183] lstrlenW (lpString=".ppt") returned 4 [0283.184] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0283.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.184] lstrlenW (lpString=".zip") returned 4 [0283.184] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0283.184] lstrlenW (lpString=".rar") returned 4 [0283.184] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0283.184] lstrlenW (lpString=".bz2") returned 4 [0283.184] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0283.184] lstrlenW (lpString=".7z") returned 3 [0283.184] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0283.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.184] lstrlenW (lpString=".dbf") returned 4 [0283.184] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0283.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.184] lstrlenW (lpString=".1cd") returned 4 [0283.184] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0283.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0283.184] lstrlenW (lpString=".jpg") returned 4 [0283.185] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0283.185] lstrcmpiW (lpString1=".xrm-ms", lpString2=".drweb") returned 1 [0283.185] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0283.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0283.185] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=715834) returned 1 [0283.186] CloseHandle (hObject=0x20c) returned 1 [0283.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0283.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0283.186] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.186] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0283.186] GetLastError () returned 0x0 [0283.186] ReadFile (in: hFile=0x20c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0283.267] WriteFile (in: hFile=0x1c0, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0283.283] ReadFile (in: hFile=0x20c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0283.283] WriteFile (in: hFile=0x1c0, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x104, lpOverlapped=0x0) returned 1 [0283.283] SetEndOfFile (hFile=0x1c0) returned 1 [0283.283] CloseHandle (hObject=0x1c0) returned 1 [0283.283] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.283] SetEndOfFile (hFile=0x20c) returned 1 [0283.476] CloseHandle (hObject=0x20c) returned 1 [0283.476] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.476] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0283.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.476] lstrlenW (lpString=".doc") returned 4 [0283.476] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.476] lstrlenW (lpString=".docx") returned 5 [0283.476] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.476] lstrlenW (lpString=".pdf") returned 4 [0283.476] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".xls") returned 4 [0283.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".xlsx") returned 5 [0283.477] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.477] lstrlenW (lpString=".ppt") returned 4 [0283.477] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.477] lstrlenW (lpString=".zip") returned 4 [0283.477] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".rar") returned 4 [0283.477] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".bz2") returned 4 [0283.477] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".7z") returned 3 [0283.477] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.477] lstrlenW (lpString=".dbf") returned 4 [0283.477] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.477] lstrlenW (lpString=".1cd") returned 4 [0283.477] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.477] lstrlenW (lpString=".jpg") returned 4 [0283.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.477] lstrlenW (lpString=".doc") returned 4 [0283.477] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".docx") returned 5 [0283.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0283.477] lstrlenW (lpString=".pdf") returned 4 [0283.477] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".xls") returned 4 [0283.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0283.477] lstrlenW (lpString=".xlsx") returned 5 [0283.477] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0283.478] lstrlenW (lpString=".ppt") returned 4 [0283.478] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0283.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.478] lstrlenW (lpString=".zip") returned 4 [0283.478] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0283.478] lstrlenW (lpString=".rar") returned 4 [0283.478] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0283.478] lstrlenW (lpString=".bz2") returned 4 [0283.478] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0283.478] lstrlenW (lpString=".7z") returned 3 [0283.478] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0283.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.478] lstrlenW (lpString=".dbf") returned 4 [0283.478] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0283.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.478] lstrlenW (lpString=".1cd") returned 4 [0283.478] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0283.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0283.478] lstrlenW (lpString=".jpg") returned 4 [0283.478] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0283.478] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0283.478] lstrlenW (lpString="setup.exe") returned 9 [0283.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.605] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1377656) returned 1 [0283.605] CloseHandle (hObject=0x1b0) returned 1 [0283.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0283.606] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0283.606] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.606] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.606] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0283.606] GetLastError () returned 0x0 [0283.606] ReadFile (in: hFile=0x1b0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0283.801] WriteFile (in: hFile=0x208, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0283.817] ReadFile (in: hFile=0x1b0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x50588, lpOverlapped=0x0) returned 1 [0283.832] WriteFile (in: hFile=0x208, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0283.839] ReadFile (in: hFile=0x1b0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0283.839] WriteFile (in: hFile=0x208, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0283.840] SetEndOfFile (hFile=0x208) returned 1 [0283.840] CloseHandle (hObject=0x208) returned 1 [0283.840] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.840] SetEndOfFile (hFile=0x1b0) returned 1 [0283.843] CloseHandle (hObject=0x1b0) returned 1 [0283.843] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.843] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0283.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.843] lstrlenW (lpString=".doc") returned 4 [0283.843] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0283.843] lstrlenW (lpString=".docx") returned 5 [0283.844] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0283.844] lstrlenW (lpString=".pdf") returned 4 [0283.844] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0283.844] lstrlenW (lpString=".xls") returned 4 [0283.844] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0283.844] lstrlenW (lpString=".xlsx") returned 5 [0283.844] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0283.844] lstrlenW (lpString=".ppt") returned 4 [0283.844] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0283.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.844] lstrlenW (lpString=".zip") returned 4 [0283.844] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0283.844] lstrlenW (lpString=".rar") returned 4 [0283.844] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0283.844] lstrlenW (lpString=".bz2") returned 4 [0283.844] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0283.844] lstrlenW (lpString=".7z") returned 3 [0283.844] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0283.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.844] lstrlenW (lpString=".dbf") returned 4 [0283.844] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0283.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.844] lstrlenW (lpString=".1cd") returned 4 [0283.844] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0283.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.844] lstrlenW (lpString=".jpg") returned 4 [0283.844] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0283.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.844] lstrlenW (lpString=".doc") returned 4 [0283.844] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0283.845] lstrlenW (lpString=".docx") returned 5 [0283.845] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0283.845] lstrlenW (lpString=".pdf") returned 4 [0283.845] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0283.845] lstrlenW (lpString=".xls") returned 4 [0283.845] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0283.845] lstrlenW (lpString=".xlsx") returned 5 [0283.845] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0283.845] lstrlenW (lpString=".ppt") returned 4 [0283.845] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0283.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.845] lstrlenW (lpString=".zip") returned 4 [0283.845] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0283.845] lstrlenW (lpString=".rar") returned 4 [0283.845] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0283.845] lstrlenW (lpString=".bz2") returned 4 [0283.845] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0283.845] lstrlenW (lpString=".7z") returned 3 [0283.845] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0283.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.845] lstrlenW (lpString=".dbf") returned 4 [0283.845] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0283.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.845] lstrlenW (lpString=".1cd") returned 4 [0283.845] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0283.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0283.845] lstrlenW (lpString=".jpg") returned 4 [0283.845] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0283.845] lstrcmpiW (lpString1=".EXE", lpString2=".drweb") returned 1 [0283.846] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0283.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0283.872] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=629664) returned 1 [0283.873] CloseHandle (hObject=0x1f0) returned 1 [0283.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0283.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0283.873] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.873] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.893] GetLastError () returned 0x0 [0283.893] ReadFile (in: hFile=0x1f0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0283.905] WriteFile (in: hFile=0x180, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0283.986] ReadFile (in: hFile=0x1f0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0283.986] WriteFile (in: hFile=0x180, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0283.987] SetEndOfFile (hFile=0x180) returned 1 [0283.995] CloseHandle (hObject=0x180) returned 1 [0283.995] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.995] SetEndOfFile (hFile=0x1f0) returned 1 [0284.001] CloseHandle (hObject=0x1f0) returned 1 [0284.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0284.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.002] lstrlenW (lpString=".doc") returned 4 [0284.002] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0284.002] lstrlenW (lpString=".docx") returned 5 [0284.003] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0284.003] lstrlenW (lpString=".pdf") returned 4 [0284.003] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0284.003] lstrlenW (lpString=".xls") returned 4 [0284.003] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0284.003] lstrlenW (lpString=".xlsx") returned 5 [0284.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0284.003] lstrlenW (lpString=".ppt") returned 4 [0284.003] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0284.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.003] lstrlenW (lpString=".zip") returned 4 [0284.003] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0284.003] lstrlenW (lpString=".rar") returned 4 [0284.003] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0284.003] lstrlenW (lpString=".bz2") returned 4 [0284.003] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0284.003] lstrlenW (lpString=".7z") returned 3 [0284.003] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0284.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.003] lstrlenW (lpString=".dbf") returned 4 [0284.003] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0284.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.003] lstrlenW (lpString=".1cd") returned 4 [0284.003] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0284.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.003] lstrlenW (lpString=".jpg") returned 4 [0284.003] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0284.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.004] lstrlenW (lpString=".doc") returned 4 [0284.004] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0284.004] lstrlenW (lpString=".docx") returned 5 [0284.004] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0284.004] lstrlenW (lpString=".pdf") returned 4 [0284.004] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0284.004] lstrlenW (lpString=".xls") returned 4 [0284.004] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0284.004] lstrlenW (lpString=".xlsx") returned 5 [0284.004] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0284.004] lstrlenW (lpString=".ppt") returned 4 [0284.004] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0284.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.004] lstrlenW (lpString=".zip") returned 4 [0284.004] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0284.004] lstrlenW (lpString=".rar") returned 4 [0284.004] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0284.004] lstrlenW (lpString=".bz2") returned 4 [0284.004] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0284.004] lstrlenW (lpString=".7z") returned 3 [0284.004] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0284.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.004] lstrlenW (lpString=".dbf") returned 4 [0284.004] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0284.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.004] lstrlenW (lpString=".1cd") returned 4 [0284.004] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0284.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0284.005] lstrlenW (lpString=".jpg") returned 4 [0284.005] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0284.005] lstrcmpiW (lpString1=".CNT", lpString2=".drweb") returned -1 [0284.005] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0284.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0284.062] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2557) returned 1 [0284.063] CloseHandle (hObject=0x1f0) returned 1 [0284.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0284.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0284.063] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.063] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0284.095] GetLastError () returned 0x0 [0284.095] ReadFile (in: hFile=0x1f0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x9fd, lpOverlapped=0x0) returned 1 [0284.127] WriteFile (in: hFile=0x180, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xa00, lpOverlapped=0x0) returned 1 [0284.128] ReadFile (in: hFile=0x1f0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.128] WriteFile (in: hFile=0x180, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0284.128] SetEndOfFile (hFile=0x180) returned 1 [0284.128] CloseHandle (hObject=0x180) returned 1 [0284.128] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.128] SetEndOfFile (hFile=0x1f0) returned 1 [0284.129] CloseHandle (hObject=0x1f0) returned 1 [0284.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.129] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0284.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.130] lstrlenW (lpString=".doc") returned 4 [0284.130] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0284.130] lstrlenW (lpString=".docx") returned 5 [0284.130] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0284.130] lstrlenW (lpString=".pdf") returned 4 [0284.130] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0284.130] lstrlenW (lpString=".xls") returned 4 [0284.130] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0284.130] lstrlenW (lpString=".xlsx") returned 5 [0284.130] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0284.130] lstrlenW (lpString=".ppt") returned 4 [0284.130] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0284.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.130] lstrlenW (lpString=".zip") returned 4 [0284.130] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0284.130] lstrlenW (lpString=".rar") returned 4 [0284.130] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0284.130] lstrlenW (lpString=".bz2") returned 4 [0284.130] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0284.130] lstrlenW (lpString=".7z") returned 3 [0284.130] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0284.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.131] lstrlenW (lpString=".dbf") returned 4 [0284.131] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.131] lstrlenW (lpString=".1cd") returned 4 [0284.131] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0284.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.131] lstrlenW (lpString=".jpg") returned 4 [0284.131] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.131] lstrlenW (lpString=".doc") returned 4 [0284.131] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString=".docx") returned 5 [0284.131] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0284.131] lstrlenW (lpString=".pdf") returned 4 [0284.131] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString=".xls") returned 4 [0284.131] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString=".xlsx") returned 5 [0284.131] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0284.131] lstrlenW (lpString=".ppt") returned 4 [0284.131] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.131] lstrlenW (lpString=".zip") returned 4 [0284.131] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0284.131] lstrlenW (lpString=".rar") returned 4 [0284.132] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0284.132] lstrlenW (lpString=".bz2") returned 4 [0284.132] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0284.132] lstrlenW (lpString=".7z") returned 3 [0284.132] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0284.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.132] lstrlenW (lpString=".dbf") returned 4 [0284.132] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0284.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.132] lstrlenW (lpString=".1cd") returned 4 [0284.132] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0284.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0284.132] lstrlenW (lpString=".jpg") returned 4 [0284.132] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0284.132] lstrcmpiW (lpString1=".EXE", lpString2=".drweb") returned 1 [0284.132] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0284.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0284.133] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=543304) returned 1 [0284.133] CloseHandle (hObject=0x1f0) returned 1 [0284.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0284.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0284.133] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.133] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0284.134] GetLastError () returned 0x0 [0284.134] ReadFile (in: hFile=0x1f0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x84a48, lpOverlapped=0x0) returned 1 [0284.333] WriteFile (in: hFile=0x180, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0284.342] ReadFile (in: hFile=0x1f0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.342] WriteFile (in: hFile=0x180, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0284.342] SetEndOfFile (hFile=0x180) returned 1 [0284.343] CloseHandle (hObject=0x180) returned 1 [0284.343] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.343] SetEndOfFile (hFile=0x1f0) returned 1 [0284.348] CloseHandle (hObject=0x1f0) returned 1 [0284.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0284.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.349] lstrlenW (lpString=".doc") returned 4 [0284.349] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0284.349] lstrlenW (lpString=".docx") returned 5 [0284.349] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0284.349] lstrlenW (lpString=".pdf") returned 4 [0284.349] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0284.349] lstrlenW (lpString=".xls") returned 4 [0284.349] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0284.349] lstrlenW (lpString=".xlsx") returned 5 [0284.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0284.349] lstrlenW (lpString=".ppt") returned 4 [0284.349] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0284.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.349] lstrlenW (lpString=".zip") returned 4 [0284.349] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0284.349] lstrlenW (lpString=".rar") returned 4 [0284.349] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0284.349] lstrlenW (lpString=".bz2") returned 4 [0284.349] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0284.349] lstrlenW (lpString=".7z") returned 3 [0284.349] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0284.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.350] lstrlenW (lpString=".dbf") returned 4 [0284.350] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0284.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.350] lstrlenW (lpString=".1cd") returned 4 [0284.350] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0284.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.350] lstrlenW (lpString=".jpg") returned 4 [0284.350] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0284.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.350] lstrlenW (lpString=".doc") returned 4 [0284.350] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0284.350] lstrlenW (lpString=".docx") returned 5 [0284.350] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0284.350] lstrlenW (lpString=".pdf") returned 4 [0284.350] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0284.350] lstrlenW (lpString=".xls") returned 4 [0284.350] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0284.350] lstrlenW (lpString=".xlsx") returned 5 [0284.350] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0284.350] lstrlenW (lpString=".ppt") returned 4 [0284.350] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0284.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.350] lstrlenW (lpString=".zip") returned 4 [0284.350] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0284.350] lstrlenW (lpString=".rar") returned 4 [0284.350] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0284.351] lstrlenW (lpString=".bz2") returned 4 [0284.351] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0284.351] lstrlenW (lpString=".7z") returned 3 [0284.351] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0284.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.351] lstrlenW (lpString=".dbf") returned 4 [0284.351] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0284.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.351] lstrlenW (lpString=".1cd") returned 4 [0284.351] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0284.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0284.351] lstrlenW (lpString=".jpg") returned 4 [0284.351] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0284.351] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0284.351] lstrlenW (lpString="odffilt.dll") returned 11 [0284.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0284.682] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1312656) returned 1 [0284.682] CloseHandle (hObject=0x1e4) returned 1 [0284.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0284.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0284.683] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.683] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0284.683] GetLastError () returned 0x0 [0284.683] ReadFile (in: hFile=0x1e4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0284.720] WriteFile (in: hFile=0x208, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0284.885] ReadFile (in: hFile=0x1e4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x407a0, lpOverlapped=0x0) returned 1 [0284.901] WriteFile (in: hFile=0x208, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0284.911] ReadFile (in: hFile=0x1e4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.911] WriteFile (in: hFile=0x208, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0284.911] SetEndOfFile (hFile=0x208) returned 1 [0284.911] CloseHandle (hObject=0x208) returned 1 [0284.912] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.912] SetEndOfFile (hFile=0x1e4) returned 1 [0285.052] CloseHandle (hObject=0x1e4) returned 1 [0285.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0285.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.052] lstrlenW (lpString=".doc") returned 4 [0285.052] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.052] lstrlenW (lpString=".docx") returned 5 [0285.052] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0285.052] lstrlenW (lpString=".pdf") returned 4 [0285.052] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.052] lstrlenW (lpString=".xls") returned 4 [0285.052] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.052] lstrlenW (lpString=".xlsx") returned 5 [0285.052] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0285.052] lstrlenW (lpString=".ppt") returned 4 [0285.052] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.052] lstrlenW (lpString=".zip") returned 4 [0285.052] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.052] lstrlenW (lpString=".rar") returned 4 [0285.052] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.052] lstrlenW (lpString=".bz2") returned 4 [0285.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.053] lstrlenW (lpString=".7z") returned 3 [0285.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString=".dbf") returned 4 [0285.053] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString=".1cd") returned 4 [0285.053] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString=".jpg") returned 4 [0285.053] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString=".doc") returned 4 [0285.053] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString=".docx") returned 5 [0285.053] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0285.053] lstrlenW (lpString=".pdf") returned 4 [0285.053] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString=".xls") returned 4 [0285.053] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString=".xlsx") returned 5 [0285.053] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0285.053] lstrlenW (lpString=".ppt") returned 4 [0285.053] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString=".zip") returned 4 [0285.053] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString=".rar") returned 4 [0285.053] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.053] lstrlenW (lpString=".bz2") returned 4 [0285.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.053] lstrlenW (lpString=".7z") returned 3 [0285.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.053] lstrlenW (lpString=".dbf") returned 4 [0285.054] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.054] lstrlenW (lpString=".1cd") returned 4 [0285.054] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0285.054] lstrlenW (lpString=".jpg") returned 4 [0285.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.054] lstrcmpiW (lpString1=".CGM", lpString2=".drweb") returned -1 [0285.054] lstrlenW (lpString="MS.CGM") returned 6 [0285.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0285.142] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1908) returned 1 [0285.142] CloseHandle (hObject=0x164) returned 1 [0285.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0285.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0285.143] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.143] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.412] GetLastError () returned 0x0 [0285.413] ReadFile (in: hFile=0x164, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x774, lpOverlapped=0x0) returned 1 [0285.442] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x780, lpOverlapped=0x0) returned 1 [0285.443] ReadFile (in: hFile=0x164, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0285.443] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0285.443] SetEndOfFile (hFile=0x204) returned 1 [0285.447] CloseHandle (hObject=0x204) returned 1 [0285.447] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.447] SetEndOfFile (hFile=0x164) returned 1 [0285.448] CloseHandle (hObject=0x164) returned 1 [0285.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.448] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0285.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.449] lstrlenW (lpString=".doc") returned 4 [0285.449] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0285.449] lstrlenW (lpString=".docx") returned 5 [0285.449] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0285.449] lstrlenW (lpString=".pdf") returned 4 [0285.449] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0285.449] lstrlenW (lpString=".xls") returned 4 [0285.449] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0285.449] lstrlenW (lpString=".xlsx") returned 5 [0285.449] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0285.449] lstrlenW (lpString=".ppt") returned 4 [0285.449] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0285.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.449] lstrlenW (lpString=".zip") returned 4 [0285.449] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0285.449] lstrlenW (lpString=".rar") returned 4 [0285.449] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0285.449] lstrlenW (lpString=".bz2") returned 4 [0285.449] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0285.449] lstrlenW (lpString=".7z") returned 3 [0285.449] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0285.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.449] lstrlenW (lpString=".dbf") returned 4 [0285.449] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0285.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.450] lstrlenW (lpString=".1cd") returned 4 [0285.450] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0285.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.450] lstrlenW (lpString=".jpg") returned 4 [0285.450] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0285.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.450] lstrlenW (lpString=".doc") returned 4 [0285.450] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0285.450] lstrlenW (lpString=".docx") returned 5 [0285.450] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0285.450] lstrlenW (lpString=".pdf") returned 4 [0285.450] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0285.450] lstrlenW (lpString=".xls") returned 4 [0285.450] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0285.450] lstrlenW (lpString=".xlsx") returned 5 [0285.450] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0285.450] lstrlenW (lpString=".ppt") returned 4 [0285.450] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0285.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.450] lstrlenW (lpString=".zip") returned 4 [0285.450] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0285.451] lstrlenW (lpString=".rar") returned 4 [0285.451] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0285.451] lstrlenW (lpString=".bz2") returned 4 [0285.451] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0285.451] lstrlenW (lpString=".7z") returned 3 [0285.451] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0285.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.452] lstrlenW (lpString=".dbf") returned 4 [0285.452] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0285.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.452] lstrlenW (lpString=".1cd") returned 4 [0285.452] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0285.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0285.452] lstrlenW (lpString=".jpg") returned 4 [0285.452] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0285.453] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0285.453] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0285.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0285.913] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1831424) returned 1 [0285.913] CloseHandle (hObject=0x1f8) returned 1 [0285.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0285.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0285.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0285.914] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0285.914] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0285.914] ReadFile (in: hFile=0x1f8, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0285.918] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0285.918] ReadFile (in: hFile=0x1f8, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0285.924] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0285.924] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0285.924] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a00058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0285.941] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.941] WriteFile (in: hFile=0x1f8, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0286.270] SetEndOfFile (hFile=0x1f8) returned 1 [0286.270] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f63888 [0286.273] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0286.273] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f63888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63888*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0286.465] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0286.465] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f63888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63888*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0286.468] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0286.468] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f63888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63888*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0286.471] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f63888 | out: hHeap=0x2e0000) returned 1 [0286.471] CloseHandle (hObject=0x1f8) returned 1 [0286.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.475] lstrlenW (lpString=".doc") returned 4 [0286.475] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0286.475] lstrlenW (lpString=".docx") returned 5 [0286.475] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0286.475] lstrlenW (lpString=".pdf") returned 4 [0286.475] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0286.475] lstrlenW (lpString=".xls") returned 4 [0286.476] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString=".xlsx") returned 5 [0286.476] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0286.476] lstrlenW (lpString=".ppt") returned 4 [0286.476] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.476] lstrlenW (lpString=".zip") returned 4 [0286.476] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString=".rar") returned 4 [0286.476] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString=".bz2") returned 4 [0286.476] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0286.476] lstrlenW (lpString=".7z") returned 3 [0286.476] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0286.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.476] lstrlenW (lpString=".dbf") returned 4 [0286.476] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0286.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.476] lstrlenW (lpString=".1cd") returned 4 [0286.476] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0286.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.476] lstrlenW (lpString=".jpg") returned 4 [0286.476] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.476] lstrlenW (lpString=".doc") returned 4 [0286.476] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString=".docx") returned 5 [0286.476] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0286.476] lstrlenW (lpString=".pdf") returned 4 [0286.476] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString=".xls") returned 4 [0286.476] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0286.476] lstrlenW (lpString=".xlsx") returned 5 [0286.476] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0286.477] lstrlenW (lpString=".ppt") returned 4 [0286.477] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0286.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.477] lstrlenW (lpString=".zip") returned 4 [0286.477] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0286.477] lstrlenW (lpString=".rar") returned 4 [0286.477] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0286.477] lstrlenW (lpString=".bz2") returned 4 [0286.477] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0286.477] lstrlenW (lpString=".7z") returned 3 [0286.477] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0286.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.477] lstrlenW (lpString=".dbf") returned 4 [0286.477] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0286.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.477] lstrlenW (lpString=".1cd") returned 4 [0286.477] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0286.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0286.477] lstrlenW (lpString=".jpg") returned 4 [0286.477] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0286.477] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.477] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0286.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.695] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2560) returned 1 [0286.695] CloseHandle (hObject=0x1f8) returned 1 [0286.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0286.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.696] lstrlenW (lpString=".doc") returned 4 [0286.696] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.696] lstrlenW (lpString=".docx") returned 5 [0286.696] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.696] lstrlenW (lpString=".pdf") returned 4 [0286.696] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.696] lstrlenW (lpString=".xls") returned 4 [0286.696] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.696] lstrlenW (lpString=".xlsx") returned 5 [0286.696] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.696] lstrlenW (lpString=".ppt") returned 4 [0286.696] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.696] lstrlenW (lpString=".zip") returned 4 [0286.696] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.696] lstrlenW (lpString=".rar") returned 4 [0286.696] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.696] lstrlenW (lpString=".bz2") returned 4 [0286.696] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.696] lstrlenW (lpString=".7z") returned 3 [0286.696] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.696] lstrlenW (lpString=".dbf") returned 4 [0286.696] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.697] lstrlenW (lpString=".1cd") returned 4 [0286.697] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.697] lstrlenW (lpString=".jpg") returned 4 [0286.697] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.697] lstrlenW (lpString=".doc") returned 4 [0286.697] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.697] lstrlenW (lpString=".docx") returned 5 [0286.697] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.697] lstrlenW (lpString=".pdf") returned 4 [0286.697] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.697] lstrlenW (lpString=".xls") returned 4 [0286.697] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.697] lstrlenW (lpString=".xlsx") returned 5 [0286.697] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.697] lstrlenW (lpString=".ppt") returned 4 [0286.699] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.699] lstrlenW (lpString=".zip") returned 4 [0286.699] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.699] lstrlenW (lpString=".rar") returned 4 [0286.699] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.699] lstrlenW (lpString=".bz2") returned 4 [0286.699] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.699] lstrlenW (lpString=".7z") returned 3 [0286.699] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.699] lstrlenW (lpString=".dbf") returned 4 [0286.699] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.699] lstrlenW (lpString=".1cd") returned 4 [0286.699] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0286.699] lstrlenW (lpString=".jpg") returned 4 [0286.699] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.699] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0286.699] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0286.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0286.726] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=695296) returned 1 [0286.726] CloseHandle (hObject=0x1e4) returned 1 [0286.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0286.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.726] lstrlenW (lpString=".doc") returned 4 [0286.726] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0286.726] lstrlenW (lpString=".docx") returned 5 [0286.726] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0286.726] lstrlenW (lpString=".pdf") returned 4 [0286.726] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0286.726] lstrlenW (lpString=".xls") returned 4 [0286.726] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0286.727] lstrlenW (lpString=".xlsx") returned 5 [0286.727] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0286.727] lstrlenW (lpString=".ppt") returned 4 [0286.727] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0286.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.727] lstrlenW (lpString=".zip") returned 4 [0286.727] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0286.727] lstrlenW (lpString=".rar") returned 4 [0286.727] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0286.727] lstrlenW (lpString=".bz2") returned 4 [0286.727] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0286.727] lstrlenW (lpString=".7z") returned 3 [0286.727] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0286.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.727] lstrlenW (lpString=".dbf") returned 4 [0286.727] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0286.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.727] lstrlenW (lpString=".1cd") returned 4 [0286.727] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0286.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.727] lstrlenW (lpString=".jpg") returned 4 [0286.727] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0286.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.727] lstrlenW (lpString=".doc") returned 4 [0286.727] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0286.727] lstrlenW (lpString=".docx") returned 5 [0286.728] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0286.728] lstrlenW (lpString=".pdf") returned 4 [0286.728] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0286.728] lstrlenW (lpString=".xls") returned 4 [0286.728] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0286.728] lstrlenW (lpString=".xlsx") returned 5 [0286.728] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0286.728] lstrlenW (lpString=".ppt") returned 4 [0286.728] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0286.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.728] lstrlenW (lpString=".zip") returned 4 [0286.728] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0286.728] lstrlenW (lpString=".rar") returned 4 [0286.728] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0286.728] lstrlenW (lpString=".bz2") returned 4 [0286.728] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0286.728] lstrlenW (lpString=".7z") returned 3 [0286.728] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0286.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.728] lstrlenW (lpString=".dbf") returned 4 [0286.728] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0286.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.728] lstrlenW (lpString=".1cd") returned 4 [0286.728] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0286.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0286.728] lstrlenW (lpString=".jpg") returned 4 [0286.729] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0286.729] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.729] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0286.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0286.729] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=26624) returned 1 [0286.729] CloseHandle (hObject=0x1e4) returned 1 [0286.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0286.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.730] lstrlenW (lpString=".doc") returned 4 [0286.730] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.730] lstrlenW (lpString=".docx") returned 5 [0286.730] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.730] lstrlenW (lpString=".pdf") returned 4 [0286.730] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.730] lstrlenW (lpString=".xls") returned 4 [0286.730] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.730] lstrlenW (lpString=".xlsx") returned 5 [0286.730] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.730] lstrlenW (lpString=".ppt") returned 4 [0286.730] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.730] lstrlenW (lpString=".zip") returned 4 [0286.730] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.730] lstrlenW (lpString=".rar") returned 4 [0286.730] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.730] lstrlenW (lpString=".bz2") returned 4 [0286.730] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.731] lstrlenW (lpString=".7z") returned 3 [0286.731] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.731] lstrlenW (lpString=".dbf") returned 4 [0286.731] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.731] lstrlenW (lpString=".1cd") returned 4 [0286.731] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.731] lstrlenW (lpString=".jpg") returned 4 [0286.731] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.731] lstrlenW (lpString=".doc") returned 4 [0286.731] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.731] lstrlenW (lpString=".docx") returned 5 [0286.731] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.731] lstrlenW (lpString=".pdf") returned 4 [0286.732] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.732] lstrlenW (lpString=".xls") returned 4 [0286.732] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.732] lstrlenW (lpString=".xlsx") returned 5 [0286.732] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.732] lstrlenW (lpString=".ppt") returned 4 [0286.732] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.732] lstrlenW (lpString=".zip") returned 4 [0286.732] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.732] lstrlenW (lpString=".rar") returned 4 [0286.732] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.732] lstrlenW (lpString=".bz2") returned 4 [0286.732] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.732] lstrlenW (lpString=".7z") returned 3 [0286.732] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.732] lstrlenW (lpString=".dbf") returned 4 [0286.732] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.732] lstrlenW (lpString=".1cd") returned 4 [0286.733] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0286.733] lstrlenW (lpString=".jpg") returned 4 [0286.733] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.733] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0286.733] lstrlenW (lpString="msinfo32.exe") returned 12 [0286.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0286.733] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=378880) returned 1 [0286.733] CloseHandle (hObject=0x1e4) returned 1 [0286.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0286.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.734] lstrlenW (lpString=".doc") returned 4 [0286.734] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0286.734] lstrlenW (lpString=".docx") returned 5 [0286.734] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0286.734] lstrlenW (lpString=".pdf") returned 4 [0286.734] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0286.734] lstrlenW (lpString=".xls") returned 4 [0286.734] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0286.734] lstrlenW (lpString=".xlsx") returned 5 [0286.734] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0286.734] lstrlenW (lpString=".ppt") returned 4 [0286.734] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0286.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.735] lstrlenW (lpString=".zip") returned 4 [0286.735] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0286.735] lstrlenW (lpString=".rar") returned 4 [0286.735] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0286.735] lstrlenW (lpString=".bz2") returned 4 [0286.735] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0286.735] lstrlenW (lpString=".7z") returned 3 [0286.735] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0286.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.735] lstrlenW (lpString=".dbf") returned 4 [0286.735] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0286.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.735] lstrlenW (lpString=".1cd") returned 4 [0286.735] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0286.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.735] lstrlenW (lpString=".jpg") returned 4 [0286.735] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0286.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.735] lstrlenW (lpString=".doc") returned 4 [0286.735] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0286.735] lstrlenW (lpString=".docx") returned 5 [0286.735] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0286.735] lstrlenW (lpString=".pdf") returned 4 [0286.735] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0286.735] lstrlenW (lpString=".xls") returned 4 [0286.735] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0286.736] lstrlenW (lpString=".xlsx") returned 5 [0286.736] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0286.736] lstrlenW (lpString=".ppt") returned 4 [0286.736] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0286.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.736] lstrlenW (lpString=".zip") returned 4 [0286.736] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0286.736] lstrlenW (lpString=".rar") returned 4 [0286.736] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0286.736] lstrlenW (lpString=".bz2") returned 4 [0286.736] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0286.736] lstrlenW (lpString=".7z") returned 3 [0286.736] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0286.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.736] lstrlenW (lpString=".dbf") returned 4 [0286.736] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0286.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.736] lstrlenW (lpString=".1cd") returned 4 [0286.736] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0286.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0286.736] lstrlenW (lpString=".jpg") returned 4 [0286.736] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0286.736] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0286.737] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0286.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0286.829] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=198056) returned 1 [0286.829] CloseHandle (hObject=0x1b0) returned 1 [0286.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0286.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0287.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0287.212] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0287.212] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0287.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0287.213] GetLastError () returned 0x0 [0287.213] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x305a8, lpOverlapped=0x0) returned 1 [0287.279] WriteFile (in: hFile=0x218, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0287.283] ReadFile (in: hFile=0x1c4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0287.283] WriteFile (in: hFile=0x218, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0287.283] SetEndOfFile (hFile=0x218) returned 1 [0287.730] CloseHandle (hObject=0x218) returned 1 [0287.731] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0287.731] SetEndOfFile (hFile=0x1c4) returned 1 [0287.732] CloseHandle (hObject=0x1c4) returned 1 [0287.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.733] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) Thread: id = 13 os_tid = 0x8d4 [0260.789] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x3890260 [0260.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38a0268 [0260.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330510 [0260.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x333230 [0260.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330528 [0260.790] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3a90020 [0260.791] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330540 [0260.791] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330540, Size=0x20) returned 0x35fad8 [0260.791] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330540 [0260.791] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330540, Size=0x20) returned 0x35fb00 [0260.791] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.791] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.791] Wow64DisableWow64FsRedirection (in: OldValue=0x2f0ff58 | out: OldValue=0x2f0ff58*=0x0) returned 1 [0260.791] lstrlenW (lpString="kernel32.dll") returned 12 [0260.791] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.791] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.791] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.792] Sleep (dwMilliseconds=0x64) [0261.579] lstrcmpiW (lpString1=".BAK", lpString2=".drweb") returned -1 [0261.579] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0261.579] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.725] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=8192) returned 1 [0261.725] CloseHandle (hObject=0x174) returned 1 [0261.725] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0261.725] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\bootsect.bak.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.725] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0261.725] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0261.726] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.726] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.726] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\bootsect.bak.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0261.726] GetLastError () returned 0x0 [0261.726] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x2000, lpOverlapped=0x0) returned 1 [0261.757] WriteFile (in: hFile=0x16c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0261.758] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.758] WriteFile (in: hFile=0x16c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.758] SetEndOfFile (hFile=0x16c) returned 1 [0261.758] CloseHandle (hObject=0x16c) returned 1 [0261.759] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.759] SetEndOfFile (hFile=0x174) returned 1 [0261.760] CloseHandle (hObject=0x174) returned 1 [0261.760] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x27) returned 1 [0261.760] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0261.761] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.761] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.761] lstrlenW (lpString=".doc") returned 4 [0261.761] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString=".docx") returned 5 [0261.761] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0261.761] lstrlenW (lpString=".pdf") returned 4 [0261.761] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString=".xls") returned 4 [0261.761] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString=".xlsx") returned 5 [0261.761] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0261.761] lstrlenW (lpString=".ppt") returned 4 [0261.761] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.761] lstrlenW (lpString=".zip") returned 4 [0261.761] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString=".rar") returned 4 [0261.761] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString=".bz2") returned 4 [0261.761] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0261.761] lstrlenW (lpString=".7z") returned 3 [0261.761] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0261.761] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.761] lstrlenW (lpString=".dbf") returned 4 [0261.761] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.762] lstrlenW (lpString=".1cd") returned 4 [0261.762] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0261.762] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.762] lstrlenW (lpString=".jpg") returned 4 [0261.762] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.762] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.762] lstrlenW (lpString=".doc") returned 4 [0261.762] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString=".docx") returned 5 [0261.762] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0261.762] lstrlenW (lpString=".pdf") returned 4 [0261.762] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString=".xls") returned 4 [0261.762] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString=".xlsx") returned 5 [0261.762] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0261.762] lstrlenW (lpString=".ppt") returned 4 [0261.762] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.762] lstrlenW (lpString=".zip") returned 4 [0261.762] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0261.762] lstrlenW (lpString=".rar") returned 4 [0261.762] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0261.763] lstrlenW (lpString=".bz2") returned 4 [0261.763] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0261.763] lstrlenW (lpString=".7z") returned 3 [0261.763] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0261.763] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.763] lstrlenW (lpString=".dbf") returned 4 [0261.763] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0261.763] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.763] lstrlenW (lpString=".1cd") returned 4 [0261.763] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0261.763] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0261.763] lstrlenW (lpString=".jpg") returned 4 [0261.763] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0261.763] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.763] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0261.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0262.088] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1450) returned 1 [0262.088] CloseHandle (hObject=0x184) returned 1 [0262.088] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0262.088] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0262.088] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.088] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0262.088] GetLastError () returned 0x0 [0262.088] ReadFile (in: hFile=0x184, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0262.181] WriteFile (in: hFile=0x188, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0262.182] ReadFile (in: hFile=0x184, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.182] WriteFile (in: hFile=0x188, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0262.182] SetEndOfFile (hFile=0x188) returned 1 [0262.367] CloseHandle (hObject=0x188) returned 1 [0262.369] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.369] SetEndOfFile (hFile=0x184) returned 1 [0262.370] CloseHandle (hObject=0x184) returned 1 [0262.370] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.371] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0262.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.371] lstrlenW (lpString=".doc") returned 4 [0262.371] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.371] lstrlenW (lpString=".docx") returned 5 [0262.371] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.371] lstrlenW (lpString=".pdf") returned 4 [0262.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.371] lstrlenW (lpString=".xls") returned 4 [0262.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.371] lstrlenW (lpString=".xlsx") returned 5 [0262.371] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.371] lstrlenW (lpString=".ppt") returned 4 [0262.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.372] lstrlenW (lpString=".zip") returned 4 [0262.372] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.372] lstrlenW (lpString=".rar") returned 4 [0262.372] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString=".bz2") returned 4 [0262.372] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString=".7z") returned 3 [0262.372] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.372] lstrlenW (lpString=".dbf") returned 4 [0262.372] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.372] lstrlenW (lpString=".1cd") returned 4 [0262.372] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.372] lstrlenW (lpString=".jpg") returned 4 [0262.372] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.372] lstrlenW (lpString=".doc") returned 4 [0262.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString=".docx") returned 5 [0262.372] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.372] lstrlenW (lpString=".pdf") returned 4 [0262.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.372] lstrlenW (lpString=".xls") returned 4 [0262.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.373] lstrlenW (lpString=".xlsx") returned 5 [0262.373] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.373] lstrlenW (lpString=".ppt") returned 4 [0262.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.373] lstrlenW (lpString=".zip") returned 4 [0262.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.373] lstrlenW (lpString=".rar") returned 4 [0262.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.373] lstrlenW (lpString=".bz2") returned 4 [0262.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.373] lstrlenW (lpString=".7z") returned 3 [0262.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.373] lstrlenW (lpString=".dbf") returned 4 [0262.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.373] lstrlenW (lpString=".1cd") returned 4 [0262.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0262.373] lstrlenW (lpString=".jpg") returned 4 [0262.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.373] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.373] lstrlenW (lpString="Setup.xml") returned 9 [0262.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0262.374] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2362) returned 1 [0262.374] CloseHandle (hObject=0x184) returned 1 [0262.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0262.374] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0262.375] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.375] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0262.375] GetLastError () returned 0x0 [0262.375] ReadFile (in: hFile=0x184, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x93a, lpOverlapped=0x0) returned 1 [0262.561] WriteFile (in: hFile=0x188, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x940, lpOverlapped=0x0) returned 1 [0262.562] ReadFile (in: hFile=0x184, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.562] WriteFile (in: hFile=0x188, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.562] SetEndOfFile (hFile=0x188) returned 1 [0262.562] CloseHandle (hObject=0x188) returned 1 [0262.563] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.563] SetEndOfFile (hFile=0x184) returned 1 [0262.564] CloseHandle (hObject=0x184) returned 1 [0262.564] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.565] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0262.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.565] lstrlenW (lpString=".doc") returned 4 [0262.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.565] lstrlenW (lpString=".docx") returned 5 [0262.565] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.565] lstrlenW (lpString=".pdf") returned 4 [0262.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.565] lstrlenW (lpString=".xls") returned 4 [0262.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.565] lstrlenW (lpString=".xlsx") returned 5 [0262.565] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.565] lstrlenW (lpString=".ppt") returned 4 [0262.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.566] lstrlenW (lpString=".zip") returned 4 [0262.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.566] lstrlenW (lpString=".rar") returned 4 [0262.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString=".bz2") returned 4 [0262.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString=".7z") returned 3 [0262.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.566] lstrlenW (lpString=".dbf") returned 4 [0262.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.566] lstrlenW (lpString=".1cd") returned 4 [0262.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.566] lstrlenW (lpString=".jpg") returned 4 [0262.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.566] lstrlenW (lpString=".doc") returned 4 [0262.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.566] lstrlenW (lpString=".docx") returned 5 [0262.567] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.567] lstrlenW (lpString=".pdf") returned 4 [0262.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.567] lstrlenW (lpString=".xls") returned 4 [0262.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.567] lstrlenW (lpString=".xlsx") returned 5 [0262.567] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.567] lstrlenW (lpString=".ppt") returned 4 [0262.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.567] lstrlenW (lpString=".zip") returned 4 [0262.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.567] lstrlenW (lpString=".rar") returned 4 [0262.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.567] lstrlenW (lpString=".bz2") returned 4 [0262.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.567] lstrlenW (lpString=".7z") returned 3 [0262.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.567] lstrlenW (lpString=".dbf") returned 4 [0262.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.567] lstrlenW (lpString=".1cd") returned 4 [0262.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.568] lstrlenW (lpString=".jpg") returned 4 [0262.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.568] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.568] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0262.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0262.569] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1231) returned 1 [0262.569] CloseHandle (hObject=0x184) returned 1 [0262.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0262.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0262.570] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.570] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0262.570] GetLastError () returned 0x0 [0262.570] ReadFile (in: hFile=0x184, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0262.626] WriteFile (in: hFile=0x188, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0262.627] ReadFile (in: hFile=0x184, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.627] WriteFile (in: hFile=0x188, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0262.628] SetEndOfFile (hFile=0x188) returned 1 [0262.628] CloseHandle (hObject=0x188) returned 1 [0262.633] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.633] SetEndOfFile (hFile=0x184) returned 1 [0262.635] CloseHandle (hObject=0x184) returned 1 [0262.635] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.635] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0262.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.636] lstrlenW (lpString=".doc") returned 4 [0262.636] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.636] lstrlenW (lpString=".docx") returned 5 [0262.636] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.636] lstrlenW (lpString=".pdf") returned 4 [0262.636] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.636] lstrlenW (lpString=".xls") returned 4 [0262.636] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.636] lstrlenW (lpString=".xlsx") returned 5 [0262.636] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.636] lstrlenW (lpString=".ppt") returned 4 [0262.636] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.636] lstrlenW (lpString=".zip") returned 4 [0262.636] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.636] lstrlenW (lpString=".rar") returned 4 [0262.636] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.636] lstrlenW (lpString=".bz2") returned 4 [0262.636] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.636] lstrlenW (lpString=".7z") returned 3 [0262.636] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.637] lstrlenW (lpString=".dbf") returned 4 [0262.637] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.637] lstrlenW (lpString=".1cd") returned 4 [0262.637] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.637] lstrlenW (lpString=".jpg") returned 4 [0262.637] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.637] lstrlenW (lpString=".doc") returned 4 [0262.637] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.637] lstrlenW (lpString=".docx") returned 5 [0262.637] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.637] lstrlenW (lpString=".pdf") returned 4 [0262.637] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.637] lstrlenW (lpString=".xls") returned 4 [0262.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.638] lstrlenW (lpString=".xlsx") returned 5 [0262.638] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.638] lstrlenW (lpString=".ppt") returned 4 [0262.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.638] lstrlenW (lpString=".zip") returned 4 [0262.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.638] lstrlenW (lpString=".rar") returned 4 [0262.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.638] lstrlenW (lpString=".bz2") returned 4 [0262.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.638] lstrlenW (lpString=".7z") returned 3 [0262.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.638] lstrlenW (lpString=".dbf") returned 4 [0262.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.638] lstrlenW (lpString=".1cd") returned 4 [0262.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0262.638] lstrlenW (lpString=".jpg") returned 4 [0262.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.639] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.639] lstrlenW (lpString="Setup.xml") returned 9 [0262.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.994] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=6241) returned 1 [0262.994] CloseHandle (hObject=0x170) returned 1 [0262.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0262.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.994] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.994] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.994] GetLastError () returned 0x0 [0262.994] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x1861, lpOverlapped=0x0) returned 1 [0263.012] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0263.013] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.013] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.013] SetEndOfFile (hFile=0x190) returned 1 [0263.013] CloseHandle (hObject=0x190) returned 1 [0263.014] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.014] SetEndOfFile (hFile=0x170) returned 1 [0263.015] CloseHandle (hObject=0x170) returned 1 [0263.015] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.016] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0263.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.016] lstrlenW (lpString=".doc") returned 4 [0263.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.016] lstrlenW (lpString=".docx") returned 5 [0263.016] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.016] lstrlenW (lpString=".pdf") returned 4 [0263.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.016] lstrlenW (lpString=".xls") returned 4 [0263.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.016] lstrlenW (lpString=".xlsx") returned 5 [0263.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.016] lstrlenW (lpString=".ppt") returned 4 [0263.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.016] lstrlenW (lpString=".zip") returned 4 [0263.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.016] lstrlenW (lpString=".rar") returned 4 [0263.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.016] lstrlenW (lpString=".bz2") returned 4 [0263.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString=".7z") returned 3 [0263.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.017] lstrlenW (lpString=".dbf") returned 4 [0263.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.017] lstrlenW (lpString=".1cd") returned 4 [0263.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.017] lstrlenW (lpString=".jpg") returned 4 [0263.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.017] lstrlenW (lpString=".doc") returned 4 [0263.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString=".docx") returned 5 [0263.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.017] lstrlenW (lpString=".pdf") returned 4 [0263.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString=".xls") returned 4 [0263.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString=".xlsx") returned 5 [0263.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.017] lstrlenW (lpString=".ppt") returned 4 [0263.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.018] lstrlenW (lpString=".zip") returned 4 [0263.018] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.018] lstrlenW (lpString=".rar") returned 4 [0263.018] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.018] lstrlenW (lpString=".bz2") returned 4 [0263.018] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.018] lstrlenW (lpString=".7z") returned 3 [0263.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.018] lstrlenW (lpString=".dbf") returned 4 [0263.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.018] lstrlenW (lpString=".1cd") returned 4 [0263.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.018] lstrlenW (lpString=".jpg") returned 4 [0263.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.018] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.018] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0263.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.020] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1452) returned 1 [0263.021] CloseHandle (hObject=0x170) returned 1 [0263.021] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0263.021] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.021] GetLastError () returned 0x0 [0263.021] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0263.094] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0263.095] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.095] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0263.095] SetEndOfFile (hFile=0x190) returned 1 [0263.096] CloseHandle (hObject=0x190) returned 1 [0263.096] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.096] SetEndOfFile (hFile=0x170) returned 1 [0263.097] CloseHandle (hObject=0x170) returned 1 [0263.098] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.098] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0263.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.098] lstrlenW (lpString=".doc") returned 4 [0263.098] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.098] lstrlenW (lpString=".docx") returned 5 [0263.098] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.098] lstrlenW (lpString=".pdf") returned 4 [0263.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.098] lstrlenW (lpString=".xls") returned 4 [0263.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.098] lstrlenW (lpString=".xlsx") returned 5 [0263.098] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.098] lstrlenW (lpString=".ppt") returned 4 [0263.099] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.099] lstrlenW (lpString=".zip") returned 4 [0263.099] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.099] lstrlenW (lpString=".rar") returned 4 [0263.099] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString=".bz2") returned 4 [0263.099] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString=".7z") returned 3 [0263.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.099] lstrlenW (lpString=".dbf") returned 4 [0263.099] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.099] lstrlenW (lpString=".1cd") returned 4 [0263.099] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.099] lstrlenW (lpString=".jpg") returned 4 [0263.099] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.099] lstrlenW (lpString=".doc") returned 4 [0263.099] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString=".docx") returned 5 [0263.099] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.099] lstrlenW (lpString=".pdf") returned 4 [0263.099] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.099] lstrlenW (lpString=".xls") returned 4 [0263.100] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.100] lstrlenW (lpString=".xlsx") returned 5 [0263.100] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.100] lstrlenW (lpString=".ppt") returned 4 [0263.100] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.100] lstrlenW (lpString=".zip") returned 4 [0263.100] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.100] lstrlenW (lpString=".rar") returned 4 [0263.100] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.100] lstrlenW (lpString=".bz2") returned 4 [0263.100] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.100] lstrlenW (lpString=".7z") returned 3 [0263.100] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.100] lstrlenW (lpString=".dbf") returned 4 [0263.100] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.100] lstrlenW (lpString=".1cd") returned 4 [0263.100] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0263.100] lstrlenW (lpString=".jpg") returned 4 [0263.100] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.109] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.109] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0263.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.109] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=913) returned 1 [0263.109] CloseHandle (hObject=0x170) returned 1 [0263.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0263.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.109] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.110] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.110] GetLastError () returned 0x0 [0263.110] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x391, lpOverlapped=0x0) returned 1 [0263.321] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0263.322] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.322] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0263.322] SetEndOfFile (hFile=0x190) returned 1 [0263.322] CloseHandle (hObject=0x190) returned 1 [0263.323] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.323] SetEndOfFile (hFile=0x170) returned 1 [0263.323] CloseHandle (hObject=0x170) returned 1 [0263.324] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.324] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0263.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.324] lstrlenW (lpString=".doc") returned 4 [0263.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.324] lstrlenW (lpString=".docx") returned 5 [0263.324] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.324] lstrlenW (lpString=".pdf") returned 4 [0263.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.324] lstrlenW (lpString=".xls") returned 4 [0263.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.324] lstrlenW (lpString=".xlsx") returned 5 [0263.325] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.325] lstrlenW (lpString=".ppt") returned 4 [0263.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.325] lstrlenW (lpString=".zip") returned 4 [0263.325] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.325] lstrlenW (lpString=".rar") returned 4 [0263.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString=".bz2") returned 4 [0263.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString=".7z") returned 3 [0263.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.325] lstrlenW (lpString=".dbf") returned 4 [0263.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.325] lstrlenW (lpString=".1cd") returned 4 [0263.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.325] lstrlenW (lpString=".jpg") returned 4 [0263.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.325] lstrlenW (lpString=".doc") returned 4 [0263.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.325] lstrlenW (lpString=".docx") returned 5 [0263.325] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.325] lstrlenW (lpString=".pdf") returned 4 [0263.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.326] lstrlenW (lpString=".xls") returned 4 [0263.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.326] lstrlenW (lpString=".xlsx") returned 5 [0263.326] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.326] lstrlenW (lpString=".ppt") returned 4 [0263.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.326] lstrlenW (lpString=".zip") returned 4 [0263.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.326] lstrlenW (lpString=".rar") returned 4 [0263.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.326] lstrlenW (lpString=".bz2") returned 4 [0263.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.326] lstrlenW (lpString=".7z") returned 3 [0263.326] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.326] lstrlenW (lpString=".dbf") returned 4 [0263.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.326] lstrlenW (lpString=".1cd") returned 4 [0263.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0263.327] lstrlenW (lpString=".jpg") returned 4 [0263.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.327] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.327] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0263.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.327] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=819) returned 1 [0263.327] CloseHandle (hObject=0x170) returned 1 [0263.327] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0263.327] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.328] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.328] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.328] GetLastError () returned 0x0 [0263.328] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x333, lpOverlapped=0x0) returned 1 [0263.457] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x340, lpOverlapped=0x0) returned 1 [0263.458] ReadFile (in: hFile=0x170, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.458] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0263.458] SetEndOfFile (hFile=0x190) returned 1 [0263.458] CloseHandle (hObject=0x190) returned 1 [0263.459] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.459] SetEndOfFile (hFile=0x170) returned 1 [0263.459] CloseHandle (hObject=0x170) returned 1 [0263.460] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.460] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0263.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.460] lstrlenW (lpString=".doc") returned 4 [0263.460] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.460] lstrlenW (lpString=".docx") returned 5 [0263.460] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0263.460] lstrlenW (lpString=".pdf") returned 4 [0263.460] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.460] lstrlenW (lpString=".xls") returned 4 [0263.460] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.460] lstrlenW (lpString=".xlsx") returned 5 [0263.460] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0263.460] lstrlenW (lpString=".ppt") returned 4 [0263.460] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.460] lstrlenW (lpString=".zip") returned 4 [0263.460] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.460] lstrlenW (lpString=".rar") returned 4 [0263.460] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.460] lstrlenW (lpString=".bz2") returned 4 [0263.460] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString=".7z") returned 3 [0263.461] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString=".dbf") returned 4 [0263.461] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString=".1cd") returned 4 [0263.461] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString=".jpg") returned 4 [0263.461] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString=".doc") returned 4 [0263.461] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString=".docx") returned 5 [0263.461] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0263.461] lstrlenW (lpString=".pdf") returned 4 [0263.461] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString=".xls") returned 4 [0263.461] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString=".xlsx") returned 5 [0263.461] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0263.461] lstrlenW (lpString=".ppt") returned 4 [0263.461] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString=".zip") returned 4 [0263.461] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.461] lstrlenW (lpString=".rar") returned 4 [0263.461] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString=".bz2") returned 4 [0263.461] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString=".7z") returned 3 [0263.461] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.461] lstrlenW (lpString=".dbf") returned 4 [0263.461] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.462] lstrlenW (lpString=".1cd") returned 4 [0263.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0263.462] lstrlenW (lpString=".jpg") returned 4 [0263.462] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.462] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.462] lstrlenW (lpString="branding.xml") returned 12 [0263.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0263.583] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=596341) returned 1 [0263.583] CloseHandle (hObject=0x1b0) returned 1 [0263.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0263.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0263.584] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.584] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0263.584] GetLastError () returned 0x0 [0263.584] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x91975, lpOverlapped=0x0) returned 1 [0263.716] WriteFile (in: hFile=0x170, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0263.729] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.729] WriteFile (in: hFile=0x170, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.729] SetEndOfFile (hFile=0x170) returned 1 [0263.729] CloseHandle (hObject=0x170) returned 1 [0263.882] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.882] SetEndOfFile (hFile=0x1b0) returned 1 [0263.957] CloseHandle (hObject=0x1b0) returned 1 [0263.957] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.957] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0263.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.958] lstrlenW (lpString=".doc") returned 4 [0263.958] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.958] lstrlenW (lpString=".docx") returned 5 [0263.958] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0263.958] lstrlenW (lpString=".pdf") returned 4 [0263.958] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.958] lstrlenW (lpString=".xls") returned 4 [0263.958] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.958] lstrlenW (lpString=".xlsx") returned 5 [0263.958] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0263.958] lstrlenW (lpString=".ppt") returned 4 [0263.958] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.958] lstrlenW (lpString=".zip") returned 4 [0263.958] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.958] lstrlenW (lpString=".rar") returned 4 [0263.958] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.958] lstrlenW (lpString=".bz2") returned 4 [0263.958] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.958] lstrlenW (lpString=".7z") returned 3 [0263.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.959] lstrlenW (lpString=".dbf") returned 4 [0263.959] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.959] lstrlenW (lpString=".1cd") returned 4 [0263.959] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.959] lstrlenW (lpString=".jpg") returned 4 [0263.959] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.959] lstrlenW (lpString=".doc") returned 4 [0263.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString=".docx") returned 5 [0263.959] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0263.959] lstrlenW (lpString=".pdf") returned 4 [0263.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString=".xls") returned 4 [0263.959] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString=".xlsx") returned 5 [0263.959] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0263.959] lstrlenW (lpString=".ppt") returned 4 [0263.959] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.959] lstrlenW (lpString=".zip") returned 4 [0263.959] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.959] lstrlenW (lpString=".rar") returned 4 [0263.959] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.960] lstrlenW (lpString=".bz2") returned 4 [0263.960] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.960] lstrlenW (lpString=".7z") returned 3 [0263.960] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.960] lstrlenW (lpString=".dbf") returned 4 [0263.960] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.960] lstrlenW (lpString=".1cd") returned 4 [0263.960] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0263.960] lstrlenW (lpString=".jpg") returned 4 [0263.960] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.960] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.960] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0263.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.988] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=16852) returned 1 [0263.988] CloseHandle (hObject=0x190) returned 1 [0263.988] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0263.988] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0263.988] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.988] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0263.989] GetLastError () returned 0x0 [0263.989] ReadFile (in: hFile=0x190, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0264.025] WriteFile (in: hFile=0x184, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0264.034] ReadFile (in: hFile=0x190, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.034] WriteFile (in: hFile=0x184, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0264.034] SetEndOfFile (hFile=0x184) returned 1 [0264.035] CloseHandle (hObject=0x184) returned 1 [0264.035] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.035] SetEndOfFile (hFile=0x190) returned 1 [0264.036] CloseHandle (hObject=0x190) returned 1 [0264.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.037] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0264.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.037] lstrlenW (lpString=".doc") returned 4 [0264.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString=".docx") returned 5 [0264.037] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.037] lstrlenW (lpString=".pdf") returned 4 [0264.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString=".xls") returned 4 [0264.037] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString=".xlsx") returned 5 [0264.037] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.037] lstrlenW (lpString=".ppt") returned 4 [0264.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.037] lstrlenW (lpString=".zip") returned 4 [0264.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.037] lstrlenW (lpString=".rar") returned 4 [0264.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString=".bz2") returned 4 [0264.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString=".7z") returned 3 [0264.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.037] lstrlenW (lpString=".dbf") returned 4 [0264.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.037] lstrlenW (lpString=".1cd") returned 4 [0264.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString=".jpg") returned 4 [0264.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString=".doc") returned 4 [0264.038] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString=".docx") returned 5 [0264.038] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.038] lstrlenW (lpString=".pdf") returned 4 [0264.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString=".xls") returned 4 [0264.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString=".xlsx") returned 5 [0264.038] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.038] lstrlenW (lpString=".ppt") returned 4 [0264.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString=".zip") returned 4 [0264.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.038] lstrlenW (lpString=".rar") returned 4 [0264.038] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString=".bz2") returned 4 [0264.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString=".7z") returned 3 [0264.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString=".dbf") returned 4 [0264.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString=".1cd") returned 4 [0264.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0264.038] lstrlenW (lpString=".jpg") returned 4 [0264.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.039] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.039] lstrlenW (lpString="Setup.xml") returned 9 [0264.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0264.039] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=20577) returned 1 [0264.039] CloseHandle (hObject=0x190) returned 1 [0264.039] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0264.039] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0264.039] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.039] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0264.047] GetLastError () returned 0x0 [0264.047] ReadFile (in: hFile=0x190, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x5061, lpOverlapped=0x0) returned 1 [0264.190] WriteFile (in: hFile=0x184, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0264.191] ReadFile (in: hFile=0x190, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.191] WriteFile (in: hFile=0x184, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.191] SetEndOfFile (hFile=0x184) returned 1 [0264.192] CloseHandle (hObject=0x184) returned 1 [0264.193] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.193] SetEndOfFile (hFile=0x190) returned 1 [0264.194] CloseHandle (hObject=0x190) returned 1 [0264.194] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.194] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0264.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.194] lstrlenW (lpString=".doc") returned 4 [0264.194] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.194] lstrlenW (lpString=".docx") returned 5 [0264.194] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0264.195] lstrlenW (lpString=".pdf") returned 4 [0264.195] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString=".xls") returned 4 [0264.195] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString=".xlsx") returned 5 [0264.195] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0264.195] lstrlenW (lpString=".ppt") returned 4 [0264.195] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.195] lstrlenW (lpString=".zip") returned 4 [0264.195] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.195] lstrlenW (lpString=".rar") returned 4 [0264.195] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString=".bz2") returned 4 [0264.195] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString=".7z") returned 3 [0264.195] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.195] lstrlenW (lpString=".dbf") returned 4 [0264.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.195] lstrlenW (lpString=".1cd") returned 4 [0264.195] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.195] lstrlenW (lpString=".jpg") returned 4 [0264.195] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.195] lstrlenW (lpString=".doc") returned 4 [0264.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString=".docx") returned 5 [0264.196] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0264.196] lstrlenW (lpString=".pdf") returned 4 [0264.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString=".xls") returned 4 [0264.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString=".xlsx") returned 5 [0264.196] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0264.196] lstrlenW (lpString=".ppt") returned 4 [0264.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.196] lstrlenW (lpString=".zip") returned 4 [0264.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.196] lstrlenW (lpString=".rar") returned 4 [0264.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString=".bz2") returned 4 [0264.196] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString=".7z") returned 3 [0264.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.196] lstrlenW (lpString=".dbf") returned 4 [0264.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.196] lstrlenW (lpString=".1cd") returned 4 [0264.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.196] lstrlenW (lpString=".jpg") returned 4 [0264.196] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.197] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0264.197] lstrlenW (lpString="MS.PNG") returned 6 [0264.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0264.204] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1682) returned 1 [0264.204] CloseHandle (hObject=0x1b0) returned 1 [0264.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0264.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0264.204] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.204] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0264.205] GetLastError () returned 0x0 [0264.205] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x692, lpOverlapped=0x0) returned 1 [0264.230] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0264.232] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.232] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0264.232] SetEndOfFile (hFile=0x1a8) returned 1 [0264.232] CloseHandle (hObject=0x1a8) returned 1 [0264.233] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.233] SetEndOfFile (hFile=0x1b0) returned 1 [0264.234] CloseHandle (hObject=0x1b0) returned 1 [0264.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0264.235] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0264.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.235] lstrlenW (lpString=".doc") returned 4 [0264.235] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0264.235] lstrlenW (lpString=".docx") returned 5 [0264.235] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0264.235] lstrlenW (lpString=".pdf") returned 4 [0264.235] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0264.235] lstrlenW (lpString=".xls") returned 4 [0264.235] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0264.235] lstrlenW (lpString=".xlsx") returned 5 [0264.235] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0264.235] lstrlenW (lpString=".ppt") returned 4 [0264.235] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0264.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.235] lstrlenW (lpString=".zip") returned 4 [0264.235] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0264.235] lstrlenW (lpString=".rar") returned 4 [0264.236] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0264.236] lstrlenW (lpString=".bz2") returned 4 [0264.236] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0264.236] lstrlenW (lpString=".7z") returned 3 [0264.236] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0264.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.236] lstrlenW (lpString=".dbf") returned 4 [0264.236] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0264.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.236] lstrlenW (lpString=".1cd") returned 4 [0264.236] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0264.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.236] lstrlenW (lpString=".jpg") returned 4 [0264.236] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0264.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.236] lstrlenW (lpString=".doc") returned 4 [0264.236] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0264.236] lstrlenW (lpString=".docx") returned 5 [0264.236] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0264.236] lstrlenW (lpString=".pdf") returned 4 [0264.236] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0264.236] lstrlenW (lpString=".xls") returned 4 [0264.236] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0264.237] lstrlenW (lpString=".xlsx") returned 5 [0264.237] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0264.237] lstrlenW (lpString=".ppt") returned 4 [0264.237] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0264.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.237] lstrlenW (lpString=".zip") returned 4 [0264.237] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0264.237] lstrlenW (lpString=".rar") returned 4 [0264.237] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0264.237] lstrlenW (lpString=".bz2") returned 4 [0264.237] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0264.237] lstrlenW (lpString=".7z") returned 3 [0264.237] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0264.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.237] lstrlenW (lpString=".dbf") returned 4 [0264.237] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0264.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.237] lstrlenW (lpString=".1cd") returned 4 [0264.237] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0264.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0264.237] lstrlenW (lpString=".jpg") returned 4 [0264.237] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0264.237] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.238] lstrlenW (lpString="boxed-correct.avi") returned 17 [0264.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.283] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=89600) returned 1 [0264.283] CloseHandle (hObject=0x1c0) returned 1 [0264.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0264.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.284] lstrlenW (lpString=".doc") returned 4 [0264.284] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString=".docx") returned 5 [0264.284] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.284] lstrlenW (lpString=".pdf") returned 4 [0264.284] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString=".xls") returned 4 [0264.284] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString=".xlsx") returned 5 [0264.284] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.284] lstrlenW (lpString=".ppt") returned 4 [0264.284] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.284] lstrlenW (lpString=".zip") returned 4 [0264.284] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString=".rar") returned 4 [0264.284] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString=".bz2") returned 4 [0264.284] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.284] lstrlenW (lpString=".7z") returned 3 [0264.284] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.285] lstrlenW (lpString=".dbf") returned 4 [0264.285] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.285] lstrlenW (lpString=".1cd") returned 4 [0264.285] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.285] lstrlenW (lpString=".jpg") returned 4 [0264.285] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.285] lstrlenW (lpString=".doc") returned 4 [0264.285] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString=".docx") returned 5 [0264.285] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.285] lstrlenW (lpString=".pdf") returned 4 [0264.285] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString=".xls") returned 4 [0264.285] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString=".xlsx") returned 5 [0264.285] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.285] lstrlenW (lpString=".ppt") returned 4 [0264.285] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.285] lstrlenW (lpString=".zip") returned 4 [0264.285] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.285] lstrlenW (lpString=".rar") returned 4 [0264.286] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.286] lstrlenW (lpString=".bz2") returned 4 [0264.286] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.286] lstrlenW (lpString=".7z") returned 3 [0264.286] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.286] lstrlenW (lpString=".dbf") returned 4 [0264.286] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.286] lstrlenW (lpString=".1cd") returned 4 [0264.286] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0264.286] lstrlenW (lpString=".jpg") returned 4 [0264.286] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.286] Sleep (dwMilliseconds=0x64) [0264.742] Sleep (dwMilliseconds=0x64) [0265.025] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.025] lstrlenW (lpString="ea.xml") returned 6 [0265.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.137] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=384) returned 1 [0265.137] CloseHandle (hObject=0x1c4) returned 1 [0265.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0265.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.137] lstrlenW (lpString=".doc") returned 4 [0265.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.137] lstrlenW (lpString=".docx") returned 5 [0265.137] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0265.138] lstrlenW (lpString=".pdf") returned 4 [0265.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString=".xls") returned 4 [0265.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString=".xlsx") returned 5 [0265.138] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0265.138] lstrlenW (lpString=".ppt") returned 4 [0265.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.138] lstrlenW (lpString=".zip") returned 4 [0265.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.138] lstrlenW (lpString=".rar") returned 4 [0265.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString=".bz2") returned 4 [0265.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString=".7z") returned 3 [0265.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.138] lstrlenW (lpString=".dbf") returned 4 [0265.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.138] lstrlenW (lpString=".1cd") returned 4 [0265.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.138] lstrlenW (lpString=".jpg") returned 4 [0265.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.139] lstrlenW (lpString=".doc") returned 4 [0265.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString=".docx") returned 5 [0265.139] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0265.139] lstrlenW (lpString=".pdf") returned 4 [0265.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString=".xls") returned 4 [0265.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString=".xlsx") returned 5 [0265.139] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0265.139] lstrlenW (lpString=".ppt") returned 4 [0265.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.139] lstrlenW (lpString=".zip") returned 4 [0265.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.139] lstrlenW (lpString=".rar") returned 4 [0265.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString=".bz2") returned 4 [0265.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString=".7z") returned 3 [0265.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.139] lstrlenW (lpString=".dbf") returned 4 [0265.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.139] lstrlenW (lpString=".1cd") returned 4 [0265.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0265.139] lstrlenW (lpString=".jpg") returned 4 [0265.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.140] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.140] lstrlenW (lpString="base.xml") returned 8 [0265.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.174] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=3150) returned 1 [0265.174] CloseHandle (hObject=0x1c4) returned 1 [0265.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0265.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.174] lstrlenW (lpString=".doc") returned 4 [0265.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.174] lstrlenW (lpString=".docx") returned 5 [0265.175] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0265.175] lstrlenW (lpString=".pdf") returned 4 [0265.175] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString=".xls") returned 4 [0265.175] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString=".xlsx") returned 5 [0265.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0265.175] lstrlenW (lpString=".ppt") returned 4 [0265.175] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.175] lstrlenW (lpString=".zip") returned 4 [0265.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.175] lstrlenW (lpString=".rar") returned 4 [0265.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString=".bz2") returned 4 [0265.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString=".7z") returned 3 [0265.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.175] lstrlenW (lpString=".dbf") returned 4 [0265.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.175] lstrlenW (lpString=".1cd") returned 4 [0265.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.175] lstrlenW (lpString=".jpg") returned 4 [0265.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.176] lstrlenW (lpString=".doc") returned 4 [0265.176] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.176] lstrlenW (lpString=".docx") returned 5 [0265.176] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0265.176] lstrlenW (lpString=".pdf") returned 4 [0265.176] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.176] lstrlenW (lpString=".xls") returned 4 [0265.176] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.176] lstrlenW (lpString=".xlsx") returned 5 [0265.176] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0265.178] lstrlenW (lpString=".ppt") returned 4 [0265.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.178] lstrlenW (lpString=".zip") returned 4 [0265.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.178] lstrlenW (lpString=".rar") returned 4 [0265.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.178] lstrlenW (lpString=".bz2") returned 4 [0265.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.178] lstrlenW (lpString=".7z") returned 3 [0265.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.178] lstrlenW (lpString=".dbf") returned 4 [0265.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.179] lstrlenW (lpString=".1cd") returned 4 [0265.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0265.179] lstrlenW (lpString=".jpg") returned 4 [0265.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.179] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.179] lstrlenW (lpString="oskmenubase.xml") returned 15 [0265.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0265.195] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=471) returned 1 [0265.195] CloseHandle (hObject=0x1c4) returned 1 [0265.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0265.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.196] lstrlenW (lpString=".doc") returned 4 [0265.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString=".docx") returned 5 [0265.196] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0265.196] lstrlenW (lpString=".pdf") returned 4 [0265.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString=".xls") returned 4 [0265.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString=".xlsx") returned 5 [0265.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0265.196] lstrlenW (lpString=".ppt") returned 4 [0265.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.196] lstrlenW (lpString=".zip") returned 4 [0265.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.196] lstrlenW (lpString=".rar") returned 4 [0265.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString=".bz2") returned 4 [0265.196] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString=".7z") returned 3 [0265.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.196] lstrlenW (lpString=".dbf") returned 4 [0265.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.196] lstrlenW (lpString=".1cd") returned 4 [0265.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.197] lstrlenW (lpString=".jpg") returned 4 [0265.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.197] lstrlenW (lpString=".doc") returned 4 [0265.197] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString=".docx") returned 5 [0265.197] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0265.197] lstrlenW (lpString=".pdf") returned 4 [0265.197] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString=".xls") returned 4 [0265.197] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString=".xlsx") returned 5 [0265.197] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0265.197] lstrlenW (lpString=".ppt") returned 4 [0265.197] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.197] lstrlenW (lpString=".zip") returned 4 [0265.197] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.197] lstrlenW (lpString=".rar") returned 4 [0265.197] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString=".bz2") returned 4 [0265.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.197] lstrlenW (lpString=".7z") returned 3 [0265.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.197] lstrlenW (lpString=".dbf") returned 4 [0265.198] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.198] lstrlenW (lpString=".1cd") returned 4 [0265.198] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0265.198] lstrlenW (lpString=".jpg") returned 4 [0265.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.198] lstrcmpiW (lpString1=".dat", lpString2=".drweb") returned -1 [0265.198] lstrlenW (lpString="hwruklm.dat") returned 11 [0265.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.523] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=3053984) returned 1 [0265.523] CloseHandle (hObject=0x1b0) returned 1 [0265.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0265.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0265.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.523] lstrlenW (lpString=".doc") returned 4 [0265.523] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.523] lstrlenW (lpString=".docx") returned 5 [0265.523] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0265.523] lstrlenW (lpString=".pdf") returned 4 [0265.523] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.523] lstrlenW (lpString=".xls") returned 4 [0265.523] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.523] lstrlenW (lpString=".xlsx") returned 5 [0265.523] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0265.523] lstrlenW (lpString=".ppt") returned 4 [0265.523] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.523] lstrlenW (lpString=".zip") returned 4 [0265.523] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString=".rar") returned 4 [0265.524] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString=".bz2") returned 4 [0265.524] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.524] lstrlenW (lpString=".7z") returned 3 [0265.524] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.524] lstrlenW (lpString=".dbf") returned 4 [0265.524] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.524] lstrlenW (lpString=".1cd") returned 4 [0265.524] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.524] lstrlenW (lpString=".jpg") returned 4 [0265.524] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.524] lstrlenW (lpString=".doc") returned 4 [0265.524] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString=".docx") returned 5 [0265.524] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0265.524] lstrlenW (lpString=".pdf") returned 4 [0265.524] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString=".xls") returned 4 [0265.524] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString=".xlsx") returned 5 [0265.524] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0265.524] lstrlenW (lpString=".ppt") returned 4 [0265.524] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.524] lstrlenW (lpString=".zip") returned 4 [0265.524] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0265.524] lstrlenW (lpString=".rar") returned 4 [0265.524] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0265.525] lstrlenW (lpString=".bz2") returned 4 [0265.525] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0265.525] lstrlenW (lpString=".7z") returned 3 [0265.525] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0265.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.525] lstrlenW (lpString=".dbf") returned 4 [0265.525] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0265.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.525] lstrlenW (lpString=".1cd") returned 4 [0265.525] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0265.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0265.525] lstrlenW (lpString=".jpg") returned 4 [0265.525] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0265.525] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.525] lstrlenW (lpString="ipsesp.xml") returned 10 [0265.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.525] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=3024) returned 1 [0265.526] CloseHandle (hObject=0x1b0) returned 1 [0265.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0265.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.526] lstrlenW (lpString=".doc") returned 4 [0265.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.526] lstrlenW (lpString=".docx") returned 5 [0265.526] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0265.526] lstrlenW (lpString=".pdf") returned 4 [0265.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.526] lstrlenW (lpString=".xls") returned 4 [0265.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.526] lstrlenW (lpString=".xlsx") returned 5 [0265.526] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0265.526] lstrlenW (lpString=".ppt") returned 4 [0265.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.526] lstrlenW (lpString=".zip") returned 4 [0265.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.526] lstrlenW (lpString=".rar") returned 4 [0265.526] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.526] lstrlenW (lpString=".bz2") returned 4 [0265.526] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.526] lstrlenW (lpString=".7z") returned 3 [0265.526] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.526] lstrlenW (lpString=".dbf") returned 4 [0265.526] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".1cd") returned 4 [0265.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".jpg") returned 4 [0265.527] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".doc") returned 4 [0265.527] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString=".docx") returned 5 [0265.527] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0265.527] lstrlenW (lpString=".pdf") returned 4 [0265.527] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString=".xls") returned 4 [0265.527] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString=".xlsx") returned 5 [0265.527] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0265.527] lstrlenW (lpString=".ppt") returned 4 [0265.527] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".zip") returned 4 [0265.527] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.527] lstrlenW (lpString=".rar") returned 4 [0265.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString=".bz2") returned 4 [0265.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString=".7z") returned 3 [0265.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".dbf") returned 4 [0265.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".1cd") returned 4 [0265.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0265.527] lstrlenW (lpString=".jpg") returned 4 [0265.528] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.528] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.528] lstrlenW (lpString="ipsfin.xml") returned 10 [0265.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.528] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2658) returned 1 [0265.528] CloseHandle (hObject=0x1b0) returned 1 [0265.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0265.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString=".doc") returned 4 [0265.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString=".docx") returned 5 [0265.529] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0265.529] lstrlenW (lpString=".pdf") returned 4 [0265.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString=".xls") returned 4 [0265.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString=".xlsx") returned 5 [0265.529] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0265.529] lstrlenW (lpString=".ppt") returned 4 [0265.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString=".zip") returned 4 [0265.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.529] lstrlenW (lpString=".rar") returned 4 [0265.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString=".bz2") returned 4 [0265.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString=".7z") returned 3 [0265.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString=".dbf") returned 4 [0265.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString=".1cd") returned 4 [0265.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString=".jpg") returned 4 [0265.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.529] lstrlenW (lpString=".doc") returned 4 [0265.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.529] lstrlenW (lpString=".docx") returned 5 [0265.529] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0265.530] lstrlenW (lpString=".pdf") returned 4 [0265.530] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString=".xls") returned 4 [0265.530] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString=".xlsx") returned 5 [0265.530] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0265.530] lstrlenW (lpString=".ppt") returned 4 [0265.530] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.530] lstrlenW (lpString=".zip") returned 4 [0265.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.530] lstrlenW (lpString=".rar") returned 4 [0265.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString=".bz2") returned 4 [0265.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString=".7z") returned 3 [0265.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.530] lstrlenW (lpString=".dbf") returned 4 [0265.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.530] lstrlenW (lpString=".1cd") returned 4 [0265.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0265.530] lstrlenW (lpString=".jpg") returned 4 [0265.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.530] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0265.530] lstrlenW (lpString="ipsfra.xml") returned 10 [0265.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0265.541] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2628) returned 1 [0265.541] CloseHandle (hObject=0x1c8) returned 1 [0265.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0265.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0265.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.541] lstrlenW (lpString=".doc") returned 4 [0265.541] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.541] lstrlenW (lpString=".docx") returned 5 [0265.541] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0265.541] lstrlenW (lpString=".pdf") returned 4 [0265.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString=".xls") returned 4 [0265.542] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString=".xlsx") returned 5 [0265.542] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0265.542] lstrlenW (lpString=".ppt") returned 4 [0265.542] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.542] lstrlenW (lpString=".zip") returned 4 [0265.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.542] lstrlenW (lpString=".rar") returned 4 [0265.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString=".bz2") returned 4 [0265.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString=".7z") returned 3 [0265.542] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.542] lstrlenW (lpString=".dbf") returned 4 [0265.542] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.542] lstrlenW (lpString=".1cd") returned 4 [0265.542] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.542] lstrlenW (lpString=".jpg") returned 4 [0265.542] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.542] lstrlenW (lpString=".doc") returned 4 [0265.542] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0265.542] lstrlenW (lpString=".docx") returned 5 [0265.542] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0265.542] lstrlenW (lpString=".pdf") returned 4 [0265.543] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString=".xls") returned 4 [0265.543] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString=".xlsx") returned 5 [0265.543] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0265.543] lstrlenW (lpString=".ppt") returned 4 [0265.543] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.543] lstrlenW (lpString=".zip") returned 4 [0265.543] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0265.543] lstrlenW (lpString=".rar") returned 4 [0265.543] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString=".bz2") returned 4 [0265.543] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString=".7z") returned 3 [0265.543] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.543] lstrlenW (lpString=".dbf") returned 4 [0265.543] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.543] lstrlenW (lpString=".1cd") returned 4 [0265.543] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0265.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0265.543] lstrlenW (lpString=".jpg") returned 4 [0265.543] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0265.543] lstrcmpiW (lpString1=".HTM", lpString2=".drweb") returned 1 [0265.543] lstrlenW (lpString="README.HTM") returned 10 [0265.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0265.548] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1941) returned 1 [0265.548] CloseHandle (hObject=0x1c8) returned 1 [0265.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0265.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0265.549] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.549] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0265.549] GetLastError () returned 0x0 [0265.549] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x795, lpOverlapped=0x0) returned 1 [0265.575] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0265.576] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.576] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0265.576] SetEndOfFile (hFile=0x1a8) returned 1 [0265.576] CloseHandle (hObject=0x1a8) returned 1 [0265.577] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.577] SetEndOfFile (hFile=0x1c8) returned 1 [0265.577] CloseHandle (hObject=0x1c8) returned 1 [0265.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0265.578] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0265.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.578] lstrlenW (lpString=".doc") returned 4 [0265.578] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0265.579] lstrlenW (lpString=".docx") returned 5 [0265.579] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0265.579] lstrlenW (lpString=".pdf") returned 4 [0265.579] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0265.579] lstrlenW (lpString=".xls") returned 4 [0265.579] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0265.579] lstrlenW (lpString=".xlsx") returned 5 [0265.579] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0265.579] lstrlenW (lpString=".ppt") returned 4 [0265.579] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0265.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.579] lstrlenW (lpString=".zip") returned 4 [0265.579] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0265.579] lstrlenW (lpString=".rar") returned 4 [0265.579] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0265.579] lstrlenW (lpString=".bz2") returned 4 [0265.579] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0265.579] lstrlenW (lpString=".7z") returned 3 [0265.579] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0265.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.579] lstrlenW (lpString=".dbf") returned 4 [0265.579] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0265.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.580] lstrlenW (lpString=".1cd") returned 4 [0265.580] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0265.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.580] lstrlenW (lpString=".jpg") returned 4 [0265.580] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0265.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.580] lstrlenW (lpString=".doc") returned 4 [0265.580] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0265.580] lstrlenW (lpString=".docx") returned 5 [0265.580] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0265.580] lstrlenW (lpString=".pdf") returned 4 [0265.580] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0265.580] lstrlenW (lpString=".xls") returned 4 [0265.580] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0265.580] lstrlenW (lpString=".xlsx") returned 5 [0265.580] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0265.580] lstrlenW (lpString=".ppt") returned 4 [0265.580] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0265.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.580] lstrlenW (lpString=".zip") returned 4 [0265.580] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0265.580] lstrlenW (lpString=".rar") returned 4 [0265.580] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0265.580] lstrlenW (lpString=".bz2") returned 4 [0265.580] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0265.580] lstrlenW (lpString=".7z") returned 3 [0265.580] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0265.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.580] lstrlenW (lpString=".dbf") returned 4 [0265.580] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0265.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.581] lstrlenW (lpString=".1cd") returned 4 [0265.581] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0265.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0265.581] lstrlenW (lpString=".jpg") returned 4 [0265.581] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0265.581] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0265.581] lstrlenW (lpString="AccessMUI.XML") returned 13 [0265.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0265.582] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1349) returned 1 [0265.582] CloseHandle (hObject=0x1c8) returned 1 [0265.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0265.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0265.582] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.582] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0265.583] GetLastError () returned 0x0 [0265.583] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x545, lpOverlapped=0x0) returned 1 [0266.540] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x550, lpOverlapped=0x0) returned 1 [0266.544] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.550] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0266.550] SetEndOfFile (hFile=0x1a8) returned 1 [0266.550] CloseHandle (hObject=0x1a8) returned 1 [0266.552] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.552] SetEndOfFile (hFile=0x1c8) returned 1 [0266.553] CloseHandle (hObject=0x1c8) returned 1 [0266.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0266.554] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0266.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.568] lstrlenW (lpString=".doc") returned 4 [0266.568] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.568] lstrlenW (lpString=".docx") returned 5 [0266.568] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0266.568] lstrlenW (lpString=".pdf") returned 4 [0266.568] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.568] lstrlenW (lpString=".xls") returned 4 [0266.568] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.568] lstrlenW (lpString=".xlsx") returned 5 [0266.568] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0266.568] lstrlenW (lpString=".ppt") returned 4 [0266.568] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.569] lstrlenW (lpString=".zip") returned 4 [0266.569] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.569] lstrlenW (lpString=".rar") returned 4 [0266.569] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.569] lstrlenW (lpString=".bz2") returned 4 [0266.569] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.569] lstrlenW (lpString=".7z") returned 3 [0266.569] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.569] lstrlenW (lpString=".dbf") returned 4 [0266.569] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.569] lstrlenW (lpString=".1cd") returned 4 [0266.569] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.569] lstrlenW (lpString=".jpg") returned 4 [0266.569] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.569] lstrlenW (lpString=".doc") returned 4 [0266.569] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0266.569] lstrlenW (lpString=".docx") returned 5 [0266.569] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0266.569] lstrlenW (lpString=".pdf") returned 4 [0266.570] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString=".xls") returned 4 [0266.570] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString=".xlsx") returned 5 [0266.570] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0266.570] lstrlenW (lpString=".ppt") returned 4 [0266.570] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.570] lstrlenW (lpString=".zip") returned 4 [0266.570] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0266.570] lstrlenW (lpString=".rar") returned 4 [0266.570] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString=".bz2") returned 4 [0266.570] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString=".7z") returned 3 [0266.570] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0266.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.570] lstrlenW (lpString=".dbf") returned 4 [0266.570] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.570] lstrlenW (lpString=".1cd") returned 4 [0266.570] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0266.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0266.608] lstrlenW (lpString=".jpg") returned 4 [0266.608] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0266.608] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0266.608] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0266.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0266.608] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=913) returned 1 [0266.608] CloseHandle (hObject=0x1c8) returned 1 [0266.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0266.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0266.609] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.609] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.218] GetLastError () returned 0x0 [0267.218] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x391, lpOverlapped=0x0) returned 1 [0267.220] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0267.221] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.221] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0267.221] SetEndOfFile (hFile=0x1f4) returned 1 [0267.221] CloseHandle (hObject=0x1f4) returned 1 [0267.222] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.222] SetEndOfFile (hFile=0x1c8) returned 1 [0267.223] CloseHandle (hObject=0x1c8) returned 1 [0267.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0267.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.224] lstrlenW (lpString=".doc") returned 4 [0267.224] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.224] lstrlenW (lpString=".docx") returned 5 [0267.224] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.224] lstrlenW (lpString=".pdf") returned 4 [0267.224] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.224] lstrlenW (lpString=".xls") returned 4 [0267.224] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.224] lstrlenW (lpString=".xlsx") returned 5 [0267.224] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.224] lstrlenW (lpString=".ppt") returned 4 [0267.224] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.224] lstrlenW (lpString=".zip") returned 4 [0267.224] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.224] lstrlenW (lpString=".rar") returned 4 [0267.224] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.225] lstrlenW (lpString=".bz2") returned 4 [0267.225] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.225] lstrlenW (lpString=".7z") returned 3 [0267.225] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.225] lstrlenW (lpString=".dbf") returned 4 [0267.225] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.225] lstrlenW (lpString=".1cd") returned 4 [0267.225] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.225] lstrlenW (lpString=".jpg") returned 4 [0267.225] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.226] lstrlenW (lpString=".doc") returned 4 [0267.226] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString=".docx") returned 5 [0267.226] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.226] lstrlenW (lpString=".pdf") returned 4 [0267.226] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString=".xls") returned 4 [0267.226] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString=".xlsx") returned 5 [0267.226] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.226] lstrlenW (lpString=".ppt") returned 4 [0267.226] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.226] lstrlenW (lpString=".zip") returned 4 [0267.226] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.226] lstrlenW (lpString=".rar") returned 4 [0267.226] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString=".bz2") returned 4 [0267.226] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString=".7z") returned 3 [0267.226] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.226] lstrlenW (lpString=".dbf") returned 4 [0267.226] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.226] lstrlenW (lpString=".1cd") returned 4 [0267.226] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0267.227] lstrlenW (lpString=".jpg") returned 4 [0267.227] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.227] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.227] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0267.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.229] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=5557) returned 1 [0267.229] CloseHandle (hObject=0x1c8) returned 1 [0267.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0267.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.230] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.230] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.230] GetLastError () returned 0x0 [0267.230] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0267.259] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0267.260] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.260] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0267.260] SetEndOfFile (hFile=0x1f4) returned 1 [0267.260] CloseHandle (hObject=0x1f4) returned 1 [0267.261] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.261] SetEndOfFile (hFile=0x1c8) returned 1 [0267.262] CloseHandle (hObject=0x1c8) returned 1 [0267.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0267.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.262] lstrlenW (lpString=".doc") returned 4 [0267.262] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.262] lstrlenW (lpString=".docx") returned 5 [0267.262] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.263] lstrlenW (lpString=".pdf") returned 4 [0267.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString=".xls") returned 4 [0267.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString=".xlsx") returned 5 [0267.263] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.263] lstrlenW (lpString=".ppt") returned 4 [0267.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.263] lstrlenW (lpString=".zip") returned 4 [0267.263] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.263] lstrlenW (lpString=".rar") returned 4 [0267.263] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString=".bz2") returned 4 [0267.263] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString=".7z") returned 3 [0267.263] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.263] lstrlenW (lpString=".dbf") returned 4 [0267.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.263] lstrlenW (lpString=".1cd") returned 4 [0267.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.263] lstrlenW (lpString=".jpg") returned 4 [0267.263] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.264] lstrlenW (lpString=".doc") returned 4 [0267.264] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString=".docx") returned 5 [0267.264] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0267.264] lstrlenW (lpString=".pdf") returned 4 [0267.264] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString=".xls") returned 4 [0267.264] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString=".xlsx") returned 5 [0267.264] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0267.264] lstrlenW (lpString=".ppt") returned 4 [0267.264] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.264] lstrlenW (lpString=".zip") returned 4 [0267.264] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.264] lstrlenW (lpString=".rar") returned 4 [0267.264] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString=".bz2") returned 4 [0267.264] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString=".7z") returned 3 [0267.264] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.264] lstrlenW (lpString=".dbf") returned 4 [0267.264] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.264] lstrlenW (lpString=".1cd") returned 4 [0267.264] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0267.265] lstrlenW (lpString=".jpg") returned 4 [0267.265] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.265] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.265] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0267.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.265] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=819) returned 1 [0267.265] CloseHandle (hObject=0x1c8) returned 1 [0267.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0267.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.266] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.266] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.266] GetLastError () returned 0x0 [0267.266] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x333, lpOverlapped=0x0) returned 1 [0267.276] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x340, lpOverlapped=0x0) returned 1 [0267.277] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.277] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0267.277] SetEndOfFile (hFile=0x1f4) returned 1 [0267.277] CloseHandle (hObject=0x1f4) returned 1 [0267.278] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.278] SetEndOfFile (hFile=0x1c8) returned 1 [0267.279] CloseHandle (hObject=0x1c8) returned 1 [0267.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.280] lstrlenW (lpString=".doc") returned 4 [0267.280] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString=".docx") returned 5 [0267.280] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0267.280] lstrlenW (lpString=".pdf") returned 4 [0267.280] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString=".xls") returned 4 [0267.280] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString=".xlsx") returned 5 [0267.280] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0267.280] lstrlenW (lpString=".ppt") returned 4 [0267.280] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.280] lstrlenW (lpString=".zip") returned 4 [0267.280] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.280] lstrlenW (lpString=".rar") returned 4 [0267.280] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString=".bz2") returned 4 [0267.280] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString=".7z") returned 3 [0267.280] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.280] lstrlenW (lpString=".dbf") returned 4 [0267.280] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.280] lstrlenW (lpString=".1cd") returned 4 [0267.280] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.280] lstrlenW (lpString=".jpg") returned 4 [0267.280] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.281] lstrlenW (lpString=".doc") returned 4 [0267.281] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString=".docx") returned 5 [0267.281] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0267.281] lstrlenW (lpString=".pdf") returned 4 [0267.281] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString=".xls") returned 4 [0267.281] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString=".xlsx") returned 5 [0267.281] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0267.281] lstrlenW (lpString=".ppt") returned 4 [0267.281] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.281] lstrlenW (lpString=".zip") returned 4 [0267.281] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0267.281] lstrlenW (lpString=".rar") returned 4 [0267.281] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString=".bz2") returned 4 [0267.281] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString=".7z") returned 3 [0267.281] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.281] lstrlenW (lpString=".dbf") returned 4 [0267.281] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.281] lstrlenW (lpString=".1cd") returned 4 [0267.281] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0267.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0267.281] lstrlenW (lpString=".jpg") returned 4 [0267.281] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0267.282] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0267.282] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0267.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.282] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=37689) returned 1 [0267.282] CloseHandle (hObject=0x1c8) returned 1 [0267.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0267.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.283] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.283] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.283] GetLastError () returned 0x0 [0267.283] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x9339, lpOverlapped=0x0) returned 1 [0267.291] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0267.292] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.292] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.292] SetEndOfFile (hFile=0x1f4) returned 1 [0267.292] CloseHandle (hObject=0x1f4) returned 1 [0267.293] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.293] SetEndOfFile (hFile=0x1c8) returned 1 [0267.294] CloseHandle (hObject=0x1c8) returned 1 [0267.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.295] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.295] lstrlenW (lpString=".doc") returned 4 [0267.295] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.295] lstrlenW (lpString=".docx") returned 5 [0267.295] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0267.295] lstrlenW (lpString=".pdf") returned 4 [0267.295] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.295] lstrlenW (lpString=".xls") returned 4 [0267.295] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.295] lstrlenW (lpString=".xlsx") returned 5 [0267.295] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0267.295] lstrlenW (lpString=".ppt") returned 4 [0267.295] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.295] lstrlenW (lpString=".zip") returned 4 [0267.295] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.295] lstrlenW (lpString=".rar") returned 4 [0267.295] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.295] lstrlenW (lpString=".bz2") returned 4 [0267.295] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.295] lstrlenW (lpString=".7z") returned 3 [0267.296] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.296] lstrlenW (lpString=".dbf") returned 4 [0267.296] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.296] lstrlenW (lpString=".1cd") returned 4 [0267.296] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.296] lstrlenW (lpString=".jpg") returned 4 [0267.296] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.296] lstrlenW (lpString=".doc") returned 4 [0267.296] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString=".docx") returned 5 [0267.296] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0267.296] lstrlenW (lpString=".pdf") returned 4 [0267.296] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString=".xls") returned 4 [0267.296] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString=".xlsx") returned 5 [0267.296] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0267.296] lstrlenW (lpString=".ppt") returned 4 [0267.296] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.296] lstrlenW (lpString=".zip") returned 4 [0267.296] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString=".rar") returned 4 [0267.296] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.296] lstrlenW (lpString=".bz2") returned 4 [0267.296] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.296] lstrlenW (lpString=".7z") returned 3 [0267.297] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.297] lstrlenW (lpString=".dbf") returned 4 [0267.297] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.297] lstrlenW (lpString=".1cd") returned 4 [0267.297] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0267.297] lstrlenW (lpString=".jpg") returned 4 [0267.297] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.297] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0267.297] lstrlenW (lpString="PSS10O.CHM") returned 10 [0267.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.297] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=26929) returned 1 [0267.297] CloseHandle (hObject=0x1c8) returned 1 [0267.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0267.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0267.298] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.298] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0267.298] GetLastError () returned 0x0 [0267.298] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x6931, lpOverlapped=0x0) returned 1 [0267.306] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0267.307] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.307] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0267.307] SetEndOfFile (hFile=0x1f4) returned 1 [0267.308] CloseHandle (hObject=0x1f4) returned 1 [0267.308] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.308] SetEndOfFile (hFile=0x1c8) returned 1 [0267.309] CloseHandle (hObject=0x1c8) returned 1 [0267.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.780] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0267.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.780] lstrlenW (lpString=".doc") returned 4 [0267.780] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.780] lstrlenW (lpString=".docx") returned 5 [0267.780] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0267.780] lstrlenW (lpString=".pdf") returned 4 [0267.780] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.780] lstrlenW (lpString=".xls") returned 4 [0267.780] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.780] lstrlenW (lpString=".xlsx") returned 5 [0267.780] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0267.780] lstrlenW (lpString=".ppt") returned 4 [0267.780] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.780] lstrlenW (lpString=".zip") returned 4 [0267.781] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".rar") returned 4 [0267.781] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".bz2") returned 4 [0267.781] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.781] lstrlenW (lpString=".7z") returned 3 [0267.781] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.781] lstrlenW (lpString=".dbf") returned 4 [0267.781] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.781] lstrlenW (lpString=".1cd") returned 4 [0267.781] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.781] lstrlenW (lpString=".jpg") returned 4 [0267.781] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.781] lstrlenW (lpString=".doc") returned 4 [0267.781] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".docx") returned 5 [0267.781] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0267.781] lstrlenW (lpString=".pdf") returned 4 [0267.781] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".xls") returned 4 [0267.781] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".xlsx") returned 5 [0267.781] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0267.781] lstrlenW (lpString=".ppt") returned 4 [0267.781] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.781] lstrlenW (lpString=".zip") returned 4 [0267.781] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".rar") returned 4 [0267.781] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.781] lstrlenW (lpString=".bz2") returned 4 [0267.782] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.782] lstrlenW (lpString=".7z") returned 3 [0267.782] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.782] lstrlenW (lpString=".dbf") returned 4 [0267.782] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.782] lstrlenW (lpString=".1cd") returned 4 [0267.782] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0267.782] lstrlenW (lpString=".jpg") returned 4 [0267.782] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.782] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.782] lstrlenW (lpString="SETUP.XML") returned 9 [0267.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0267.946] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1988) returned 1 [0267.946] CloseHandle (hObject=0x1b0) returned 1 [0267.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0267.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0267.946] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.946] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0267.947] GetLastError () returned 0x0 [0267.947] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0268.158] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0268.159] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.159] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.159] SetEndOfFile (hFile=0x1e4) returned 1 [0268.160] CloseHandle (hObject=0x1e4) returned 1 [0268.160] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.160] SetEndOfFile (hFile=0x1b0) returned 1 [0268.161] CloseHandle (hObject=0x1b0) returned 1 [0268.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0268.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.162] lstrlenW (lpString=".doc") returned 4 [0268.162] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.162] lstrlenW (lpString=".docx") returned 5 [0268.162] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.162] lstrlenW (lpString=".pdf") returned 4 [0268.162] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.162] lstrlenW (lpString=".xls") returned 4 [0268.162] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.162] lstrlenW (lpString=".xlsx") returned 5 [0268.162] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.162] lstrlenW (lpString=".ppt") returned 4 [0268.162] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.162] lstrlenW (lpString=".zip") returned 4 [0268.162] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.162] lstrlenW (lpString=".rar") returned 4 [0268.162] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.162] lstrlenW (lpString=".bz2") returned 4 [0268.162] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.162] lstrlenW (lpString=".7z") returned 3 [0268.162] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.162] lstrlenW (lpString=".dbf") returned 4 [0268.163] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.163] lstrlenW (lpString=".1cd") returned 4 [0268.163] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.163] lstrlenW (lpString=".jpg") returned 4 [0268.163] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.163] lstrlenW (lpString=".doc") returned 4 [0268.163] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString=".docx") returned 5 [0268.163] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.163] lstrlenW (lpString=".pdf") returned 4 [0268.163] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString=".xls") returned 4 [0268.163] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString=".xlsx") returned 5 [0268.163] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.163] lstrlenW (lpString=".ppt") returned 4 [0268.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.163] lstrlenW (lpString=".zip") returned 4 [0268.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.163] lstrlenW (lpString=".rar") returned 4 [0268.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.163] lstrlenW (lpString=".bz2") returned 4 [0268.164] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.164] lstrlenW (lpString=".7z") returned 3 [0268.164] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.164] lstrlenW (lpString=".dbf") returned 4 [0268.164] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.164] lstrlenW (lpString=".1cd") returned 4 [0268.164] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0268.164] lstrlenW (lpString=".jpg") returned 4 [0268.164] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.164] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.164] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0268.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0268.494] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=6421) returned 1 [0268.494] CloseHandle (hObject=0x1c8) returned 1 [0268.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0268.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0268.494] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.494] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0269.126] GetLastError () returned 0x0 [0269.126] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x1915, lpOverlapped=0x0) returned 1 [0269.603] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0269.604] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.604] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0269.605] SetEndOfFile (hFile=0x164) returned 1 [0269.605] CloseHandle (hObject=0x164) returned 1 [0269.606] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.606] SetEndOfFile (hFile=0x1c8) returned 1 [0269.606] CloseHandle (hObject=0x1c8) returned 1 [0269.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.607] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0269.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.607] lstrlenW (lpString=".doc") returned 4 [0269.607] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.607] lstrlenW (lpString=".docx") returned 5 [0269.607] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0269.607] lstrlenW (lpString=".pdf") returned 4 [0269.607] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.607] lstrlenW (lpString=".xls") returned 4 [0269.607] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString=".xlsx") returned 5 [0269.608] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0269.608] lstrlenW (lpString=".ppt") returned 4 [0269.608] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.608] lstrlenW (lpString=".zip") returned 4 [0269.608] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.608] lstrlenW (lpString=".rar") returned 4 [0269.608] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString=".bz2") returned 4 [0269.608] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString=".7z") returned 3 [0269.608] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.608] lstrlenW (lpString=".dbf") returned 4 [0269.608] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.608] lstrlenW (lpString=".1cd") returned 4 [0269.608] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.608] lstrlenW (lpString=".jpg") returned 4 [0269.608] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.608] lstrlenW (lpString=".doc") returned 4 [0269.608] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.608] lstrlenW (lpString=".docx") returned 5 [0269.609] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0269.609] lstrlenW (lpString=".pdf") returned 4 [0269.609] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString=".xls") returned 4 [0269.609] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString=".xlsx") returned 5 [0269.609] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0269.609] lstrlenW (lpString=".ppt") returned 4 [0269.609] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.609] lstrlenW (lpString=".zip") returned 4 [0269.609] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.609] lstrlenW (lpString=".rar") returned 4 [0269.609] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString=".bz2") returned 4 [0269.609] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString=".7z") returned 3 [0269.609] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.609] lstrlenW (lpString=".dbf") returned 4 [0269.609] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.609] lstrlenW (lpString=".1cd") returned 4 [0269.609] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0269.609] lstrlenW (lpString=".jpg") returned 4 [0269.609] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.610] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.610] lstrlenW (lpString="SETUP.XML") returned 9 [0269.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0269.962] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1608) returned 1 [0269.962] CloseHandle (hObject=0x1e4) returned 1 [0269.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0269.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0269.962] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.963] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0269.963] GetLastError () returned 0x0 [0269.963] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x648, lpOverlapped=0x0) returned 1 [0270.027] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x650, lpOverlapped=0x0) returned 1 [0270.028] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.028] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0270.028] SetEndOfFile (hFile=0x164) returned 1 [0270.028] CloseHandle (hObject=0x164) returned 1 [0270.029] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.029] SetEndOfFile (hFile=0x1e4) returned 1 [0270.030] CloseHandle (hObject=0x1e4) returned 1 [0270.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.031] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0270.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.031] lstrlenW (lpString=".doc") returned 4 [0270.031] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.031] lstrlenW (lpString=".docx") returned 5 [0270.031] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0270.031] lstrlenW (lpString=".pdf") returned 4 [0270.031] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.031] lstrlenW (lpString=".xls") returned 4 [0270.031] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.031] lstrlenW (lpString=".xlsx") returned 5 [0270.031] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0270.031] lstrlenW (lpString=".ppt") returned 4 [0270.031] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.031] lstrlenW (lpString=".zip") returned 4 [0270.031] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.031] lstrlenW (lpString=".rar") returned 4 [0270.031] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.031] lstrlenW (lpString=".bz2") returned 4 [0270.032] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString=".7z") returned 3 [0270.032] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.032] lstrlenW (lpString=".dbf") returned 4 [0270.032] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.032] lstrlenW (lpString=".1cd") returned 4 [0270.032] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.032] lstrlenW (lpString=".jpg") returned 4 [0270.032] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.032] lstrlenW (lpString=".doc") returned 4 [0270.032] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString=".docx") returned 5 [0270.032] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0270.032] lstrlenW (lpString=".pdf") returned 4 [0270.032] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString=".xls") returned 4 [0270.032] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString=".xlsx") returned 5 [0270.032] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0270.032] lstrlenW (lpString=".ppt") returned 4 [0270.032] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.032] lstrlenW (lpString=".zip") returned 4 [0270.032] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.032] lstrlenW (lpString=".rar") returned 4 [0270.032] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.033] lstrlenW (lpString=".bz2") returned 4 [0270.033] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.033] lstrlenW (lpString=".7z") returned 3 [0270.033] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.033] lstrlenW (lpString=".dbf") returned 4 [0270.033] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.033] lstrlenW (lpString=".1cd") returned 4 [0270.033] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0270.033] lstrlenW (lpString=".jpg") returned 4 [0270.033] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.033] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0270.033] lstrlenW (lpString="PHONE.XML") returned 9 [0270.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.033] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1844) returned 1 [0270.033] CloseHandle (hObject=0x1e4) returned 1 [0270.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0270.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.034] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.034] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0270.034] GetLastError () returned 0x0 [0270.034] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x734, lpOverlapped=0x0) returned 1 [0270.049] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x740, lpOverlapped=0x0) returned 1 [0270.050] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.050] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0270.050] SetEndOfFile (hFile=0x164) returned 1 [0270.051] CloseHandle (hObject=0x164) returned 1 [0270.051] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.051] SetEndOfFile (hFile=0x1e4) returned 1 [0270.052] CloseHandle (hObject=0x1e4) returned 1 [0270.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0270.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.053] lstrlenW (lpString=".doc") returned 4 [0270.053] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.053] lstrlenW (lpString=".docx") returned 5 [0270.053] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0270.053] lstrlenW (lpString=".pdf") returned 4 [0270.053] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.053] lstrlenW (lpString=".xls") returned 4 [0270.053] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.053] lstrlenW (lpString=".xlsx") returned 5 [0270.053] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0270.053] lstrlenW (lpString=".ppt") returned 4 [0270.053] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.053] lstrlenW (lpString=".zip") returned 4 [0270.053] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.053] lstrlenW (lpString=".rar") returned 4 [0270.053] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString=".bz2") returned 4 [0270.054] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString=".7z") returned 3 [0270.054] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.054] lstrlenW (lpString=".dbf") returned 4 [0270.054] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.054] lstrlenW (lpString=".1cd") returned 4 [0270.054] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.054] lstrlenW (lpString=".jpg") returned 4 [0270.054] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.054] lstrlenW (lpString=".doc") returned 4 [0270.054] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString=".docx") returned 5 [0270.054] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0270.054] lstrlenW (lpString=".pdf") returned 4 [0270.054] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString=".xls") returned 4 [0270.054] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString=".xlsx") returned 5 [0270.054] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0270.054] lstrlenW (lpString=".ppt") returned 4 [0270.054] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.054] lstrlenW (lpString=".zip") returned 4 [0270.054] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.054] lstrlenW (lpString=".rar") returned 4 [0270.055] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.055] lstrlenW (lpString=".bz2") returned 4 [0270.055] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.055] lstrlenW (lpString=".7z") returned 3 [0270.055] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.055] lstrlenW (lpString=".dbf") returned 4 [0270.055] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.055] lstrlenW (lpString=".1cd") returned 4 [0270.055] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0270.055] lstrlenW (lpString=".jpg") returned 4 [0270.055] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.055] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0270.055] lstrlenW (lpString="STOCKS.XML") returned 10 [0270.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.056] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2687) returned 1 [0270.056] CloseHandle (hObject=0x1e4) returned 1 [0270.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0270.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.056] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.056] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0270.057] GetLastError () returned 0x0 [0270.057] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0270.061] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0270.062] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.062] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0270.062] SetEndOfFile (hFile=0x164) returned 1 [0270.063] CloseHandle (hObject=0x164) returned 1 [0270.063] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.063] SetEndOfFile (hFile=0x1e4) returned 1 [0270.064] CloseHandle (hObject=0x1e4) returned 1 [0270.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0270.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.065] lstrlenW (lpString=".doc") returned 4 [0270.065] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.065] lstrlenW (lpString=".docx") returned 5 [0270.065] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0270.065] lstrlenW (lpString=".pdf") returned 4 [0270.065] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.065] lstrlenW (lpString=".xls") returned 4 [0270.065] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.065] lstrlenW (lpString=".xlsx") returned 5 [0270.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0270.065] lstrlenW (lpString=".ppt") returned 4 [0270.065] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.065] lstrlenW (lpString=".zip") returned 4 [0270.065] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.066] lstrlenW (lpString=".rar") returned 4 [0270.066] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString=".bz2") returned 4 [0270.066] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString=".7z") returned 3 [0270.066] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.066] lstrlenW (lpString=".dbf") returned 4 [0270.066] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.066] lstrlenW (lpString=".1cd") returned 4 [0270.066] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.066] lstrlenW (lpString=".jpg") returned 4 [0270.066] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.066] lstrlenW (lpString=".doc") returned 4 [0270.066] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString=".docx") returned 5 [0270.066] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0270.066] lstrlenW (lpString=".pdf") returned 4 [0270.066] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString=".xls") returned 4 [0270.066] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString=".xlsx") returned 5 [0270.066] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0270.066] lstrlenW (lpString=".ppt") returned 4 [0270.066] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.066] lstrlenW (lpString=".zip") returned 4 [0270.066] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.067] lstrlenW (lpString=".rar") returned 4 [0270.067] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.067] lstrlenW (lpString=".bz2") returned 4 [0270.067] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.067] lstrlenW (lpString=".7z") returned 3 [0270.067] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.067] lstrlenW (lpString=".dbf") returned 4 [0270.067] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.067] lstrlenW (lpString=".1cd") returned 4 [0270.067] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0270.067] lstrlenW (lpString=".jpg") returned 4 [0270.067] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.067] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0270.067] lstrlenW (lpString="TIME.XML") returned 8 [0270.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.068] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=8564) returned 1 [0270.068] CloseHandle (hObject=0x1e4) returned 1 [0270.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0270.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.068] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.068] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0270.068] GetLastError () returned 0x0 [0270.068] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x2174, lpOverlapped=0x0) returned 1 [0270.077] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0270.078] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.078] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0270.078] SetEndOfFile (hFile=0x164) returned 1 [0270.078] CloseHandle (hObject=0x164) returned 1 [0270.080] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.080] SetEndOfFile (hFile=0x1e4) returned 1 [0270.081] CloseHandle (hObject=0x1e4) returned 1 [0270.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.081] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0270.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.081] lstrlenW (lpString=".doc") returned 4 [0270.081] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.081] lstrlenW (lpString=".docx") returned 5 [0270.081] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0270.081] lstrlenW (lpString=".pdf") returned 4 [0270.081] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.081] lstrlenW (lpString=".xls") returned 4 [0270.081] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.081] lstrlenW (lpString=".xlsx") returned 5 [0270.081] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0270.081] lstrlenW (lpString=".ppt") returned 4 [0270.082] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.082] lstrlenW (lpString=".zip") returned 4 [0270.082] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.082] lstrlenW (lpString=".rar") returned 4 [0270.082] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString=".bz2") returned 4 [0270.082] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString=".7z") returned 3 [0270.082] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.082] lstrlenW (lpString=".dbf") returned 4 [0270.082] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.082] lstrlenW (lpString=".1cd") returned 4 [0270.082] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.082] lstrlenW (lpString=".jpg") returned 4 [0270.082] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.082] lstrlenW (lpString=".doc") returned 4 [0270.082] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString=".docx") returned 5 [0270.082] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0270.082] lstrlenW (lpString=".pdf") returned 4 [0270.082] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString=".xls") returned 4 [0270.082] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.082] lstrlenW (lpString=".xlsx") returned 5 [0270.082] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0270.082] lstrlenW (lpString=".ppt") returned 4 [0270.083] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.083] lstrlenW (lpString=".zip") returned 4 [0270.083] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.083] lstrlenW (lpString=".rar") returned 4 [0270.083] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.083] lstrlenW (lpString=".bz2") returned 4 [0270.083] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.083] lstrlenW (lpString=".7z") returned 3 [0270.083] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.083] lstrlenW (lpString=".dbf") returned 4 [0270.083] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.083] lstrlenW (lpString=".1cd") returned 4 [0270.083] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0270.083] lstrlenW (lpString=".jpg") returned 4 [0270.083] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.083] lstrcmpiW (lpString1=".XSL", lpString2=".drweb") returned 1 [0270.083] lstrlenW (lpString="BASMLA.XSL") returned 10 [0270.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.084] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=227311) returned 1 [0270.084] CloseHandle (hObject=0x1e4) returned 1 [0270.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0270.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0270.085] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.085] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0270.085] GetLastError () returned 0x0 [0270.085] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0270.387] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0270.391] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.391] WriteFile (in: hFile=0x164, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0270.392] SetEndOfFile (hFile=0x164) returned 1 [0270.392] CloseHandle (hObject=0x164) returned 1 [0270.395] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.395] SetEndOfFile (hFile=0x1e4) returned 1 [0270.428] CloseHandle (hObject=0x1e4) returned 1 [0270.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0270.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.428] lstrlenW (lpString=".doc") returned 4 [0270.429] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString=".docx") returned 5 [0270.429] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0270.429] lstrlenW (lpString=".pdf") returned 4 [0270.429] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString=".xls") returned 4 [0270.429] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString=".xlsx") returned 5 [0270.429] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0270.429] lstrlenW (lpString=".ppt") returned 4 [0270.429] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.429] lstrlenW (lpString=".zip") returned 4 [0270.429] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0270.429] lstrlenW (lpString=".rar") returned 4 [0270.429] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString=".bz2") returned 4 [0270.429] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString=".7z") returned 3 [0270.429] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0270.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.429] lstrlenW (lpString=".dbf") returned 4 [0270.429] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.429] lstrlenW (lpString=".1cd") returned 4 [0270.429] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0270.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.429] lstrlenW (lpString=".jpg") returned 4 [0270.429] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.430] lstrlenW (lpString=".doc") returned 4 [0270.430] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString=".docx") returned 5 [0270.430] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0270.430] lstrlenW (lpString=".pdf") returned 4 [0270.430] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString=".xls") returned 4 [0270.430] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString=".xlsx") returned 5 [0270.430] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0270.430] lstrlenW (lpString=".ppt") returned 4 [0270.430] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.430] lstrlenW (lpString=".zip") returned 4 [0270.430] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0270.430] lstrlenW (lpString=".rar") returned 4 [0270.430] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString=".bz2") returned 4 [0270.430] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString=".7z") returned 3 [0270.430] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0270.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.430] lstrlenW (lpString=".dbf") returned 4 [0270.430] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.430] lstrlenW (lpString=".1cd") returned 4 [0270.430] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0270.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0270.430] lstrlenW (lpString=".jpg") returned 4 [0270.430] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0270.431] lstrcmpiW (lpString1=".emf", lpString2=".drweb") returned 1 [0270.431] lstrlenW (lpString="Genko_2.emf") returned 11 [0270.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.860] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=10340) returned 1 [0270.860] CloseHandle (hObject=0x174) returned 1 [0270.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0270.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.861] lstrlenW (lpString=".doc") returned 4 [0270.861] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0270.861] lstrlenW (lpString=".docx") returned 5 [0270.861] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0270.861] lstrlenW (lpString=".pdf") returned 4 [0270.861] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0270.861] lstrlenW (lpString=".xls") returned 4 [0270.861] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0270.861] lstrlenW (lpString=".xlsx") returned 5 [0270.861] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0270.861] lstrlenW (lpString=".ppt") returned 4 [0270.861] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0270.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.861] lstrlenW (lpString=".zip") returned 4 [0270.861] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0270.861] lstrlenW (lpString=".rar") returned 4 [0270.861] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0270.861] lstrlenW (lpString=".bz2") returned 4 [0270.862] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0270.862] lstrlenW (lpString=".7z") returned 3 [0270.862] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0270.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.862] lstrlenW (lpString=".dbf") returned 4 [0270.862] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0270.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.862] lstrlenW (lpString=".1cd") returned 4 [0270.862] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0270.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.862] lstrlenW (lpString=".jpg") returned 4 [0270.862] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0270.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.862] lstrlenW (lpString=".doc") returned 4 [0270.862] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0270.862] lstrlenW (lpString=".docx") returned 5 [0270.862] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0270.862] lstrlenW (lpString=".pdf") returned 4 [0270.862] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0270.862] lstrlenW (lpString=".xls") returned 4 [0270.862] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0270.862] lstrlenW (lpString=".xlsx") returned 5 [0270.862] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0270.862] lstrlenW (lpString=".ppt") returned 4 [0270.862] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0270.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.862] lstrlenW (lpString=".zip") returned 4 [0270.863] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0270.863] lstrlenW (lpString=".rar") returned 4 [0270.863] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0270.863] lstrlenW (lpString=".bz2") returned 4 [0270.863] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0270.863] lstrlenW (lpString=".7z") returned 3 [0270.863] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0270.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.863] lstrlenW (lpString=".dbf") returned 4 [0270.863] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0270.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.863] lstrlenW (lpString=".1cd") returned 4 [0270.863] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0270.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0270.863] lstrlenW (lpString=".jpg") returned 4 [0270.863] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0270.863] lstrcmpiW (lpString1=".htm", lpString2=".drweb") returned 1 [0270.863] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0270.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.864] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=237) returned 1 [0270.864] CloseHandle (hObject=0x174) returned 1 [0270.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0270.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.865] lstrlenW (lpString=".doc") returned 4 [0270.865] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.865] lstrlenW (lpString=".docx") returned 5 [0270.865] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.865] lstrlenW (lpString=".pdf") returned 4 [0270.865] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.865] lstrlenW (lpString=".xls") returned 4 [0270.865] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.865] lstrlenW (lpString=".xlsx") returned 5 [0270.865] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.865] lstrlenW (lpString=".ppt") returned 4 [0270.865] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.865] lstrlenW (lpString=".zip") returned 4 [0270.865] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.865] lstrlenW (lpString=".rar") returned 4 [0270.865] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.865] lstrlenW (lpString=".bz2") returned 4 [0270.865] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.865] lstrlenW (lpString=".7z") returned 3 [0270.865] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.866] lstrlenW (lpString=".dbf") returned 4 [0270.866] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.866] lstrlenW (lpString=".1cd") returned 4 [0270.866] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.866] lstrlenW (lpString=".jpg") returned 4 [0270.866] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.866] lstrlenW (lpString=".doc") returned 4 [0270.866] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.866] lstrlenW (lpString=".docx") returned 5 [0270.866] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.866] lstrlenW (lpString=".pdf") returned 4 [0270.866] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.866] lstrlenW (lpString=".xls") returned 4 [0270.866] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.866] lstrlenW (lpString=".xlsx") returned 5 [0270.867] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.867] lstrlenW (lpString=".ppt") returned 4 [0270.867] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.867] lstrlenW (lpString=".zip") returned 4 [0270.867] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.867] lstrlenW (lpString=".rar") returned 4 [0270.867] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.867] lstrlenW (lpString=".bz2") returned 4 [0270.867] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.867] lstrlenW (lpString=".7z") returned 3 [0270.867] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.867] lstrlenW (lpString=".dbf") returned 4 [0270.867] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.867] lstrlenW (lpString=".1cd") returned 4 [0270.867] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0270.867] lstrlenW (lpString=".jpg") returned 4 [0270.867] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.867] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.867] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0270.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.868] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=6406) returned 1 [0270.868] CloseHandle (hObject=0x174) returned 1 [0270.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0270.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.868] lstrlenW (lpString=".doc") returned 4 [0270.868] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.868] lstrlenW (lpString=".docx") returned 5 [0270.868] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.868] lstrlenW (lpString=".pdf") returned 4 [0270.869] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.869] lstrlenW (lpString=".xls") returned 4 [0270.869] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.869] lstrlenW (lpString=".xlsx") returned 5 [0270.869] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.869] lstrlenW (lpString=".ppt") returned 4 [0270.869] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.869] lstrlenW (lpString=".zip") returned 4 [0270.869] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.869] lstrlenW (lpString=".rar") returned 4 [0270.869] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.869] lstrlenW (lpString=".bz2") returned 4 [0270.869] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.869] lstrlenW (lpString=".7z") returned 3 [0270.869] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.869] lstrlenW (lpString=".dbf") returned 4 [0270.869] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.869] lstrlenW (lpString=".1cd") returned 4 [0270.869] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.869] lstrlenW (lpString=".jpg") returned 4 [0270.869] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.869] lstrlenW (lpString=".doc") returned 4 [0270.870] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.870] lstrlenW (lpString=".docx") returned 5 [0270.870] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.870] lstrlenW (lpString=".pdf") returned 4 [0270.870] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.870] lstrlenW (lpString=".xls") returned 4 [0270.870] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.870] lstrlenW (lpString=".xlsx") returned 5 [0270.870] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.870] lstrlenW (lpString=".ppt") returned 4 [0270.870] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.870] lstrlenW (lpString=".zip") returned 4 [0270.870] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.870] lstrlenW (lpString=".rar") returned 4 [0270.870] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.870] lstrlenW (lpString=".bz2") returned 4 [0270.870] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.870] lstrlenW (lpString=".7z") returned 3 [0270.870] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.870] lstrlenW (lpString=".dbf") returned 4 [0270.870] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.870] lstrlenW (lpString=".1cd") returned 4 [0270.870] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0270.870] lstrlenW (lpString=".jpg") returned 4 [0270.870] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.871] lstrcmpiW (lpString1=".wmf", lpString2=".drweb") returned 1 [0270.871] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0270.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.871] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2920) returned 1 [0270.871] CloseHandle (hObject=0x174) returned 1 [0270.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0270.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.872] lstrlenW (lpString=".doc") returned 4 [0270.872] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0270.872] lstrlenW (lpString=".docx") returned 5 [0270.872] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0270.872] lstrlenW (lpString=".pdf") returned 4 [0270.872] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0270.872] lstrlenW (lpString=".xls") returned 4 [0270.872] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0270.872] lstrlenW (lpString=".xlsx") returned 5 [0270.872] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0270.872] lstrlenW (lpString=".ppt") returned 4 [0270.872] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0270.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.872] lstrlenW (lpString=".zip") returned 4 [0270.872] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0270.872] lstrlenW (lpString=".rar") returned 4 [0270.872] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0270.872] lstrlenW (lpString=".bz2") returned 4 [0270.872] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0270.872] lstrlenW (lpString=".7z") returned 3 [0270.872] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0270.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.872] lstrlenW (lpString=".dbf") returned 4 [0270.872] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0270.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.872] lstrlenW (lpString=".1cd") returned 4 [0270.873] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.873] lstrlenW (lpString=".jpg") returned 4 [0270.873] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.873] lstrlenW (lpString=".doc") returned 4 [0270.873] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString=".docx") returned 5 [0270.873] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0270.873] lstrlenW (lpString=".pdf") returned 4 [0270.873] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString=".xls") returned 4 [0270.873] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0270.873] lstrlenW (lpString=".xlsx") returned 5 [0270.873] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0270.873] lstrlenW (lpString=".ppt") returned 4 [0270.873] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.873] lstrlenW (lpString=".zip") returned 4 [0270.873] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0270.873] lstrlenW (lpString=".rar") returned 4 [0270.873] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString=".bz2") returned 4 [0270.873] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0270.873] lstrlenW (lpString=".7z") returned 3 [0270.874] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0270.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.874] lstrlenW (lpString=".dbf") returned 4 [0270.874] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0270.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.874] lstrlenW (lpString=".1cd") returned 4 [0270.874] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0270.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0270.874] lstrlenW (lpString=".jpg") returned 4 [0270.874] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0270.874] lstrcmpiW (lpString1=".wmf", lpString2=".drweb") returned 1 [0270.874] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0270.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.874] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=7498) returned 1 [0270.875] CloseHandle (hObject=0x174) returned 1 [0270.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0270.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.875] lstrlenW (lpString=".doc") returned 4 [0270.875] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0270.875] lstrlenW (lpString=".docx") returned 5 [0270.875] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0270.875] lstrlenW (lpString=".pdf") returned 4 [0270.875] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0270.875] lstrlenW (lpString=".xls") returned 4 [0270.875] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0270.875] lstrlenW (lpString=".xlsx") returned 5 [0270.875] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0270.876] lstrlenW (lpString=".ppt") returned 4 [0270.876] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.876] lstrlenW (lpString=".zip") returned 4 [0270.876] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0270.876] lstrlenW (lpString=".rar") returned 4 [0270.876] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString=".bz2") returned 4 [0270.876] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString=".7z") returned 3 [0270.876] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0270.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.876] lstrlenW (lpString=".dbf") returned 4 [0270.876] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.876] lstrlenW (lpString=".1cd") returned 4 [0270.876] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.876] lstrlenW (lpString=".jpg") returned 4 [0270.876] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.876] lstrlenW (lpString=".doc") returned 4 [0270.876] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0270.876] lstrlenW (lpString=".docx") returned 5 [0270.876] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0270.876] lstrlenW (lpString=".pdf") returned 4 [0270.877] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0270.877] lstrlenW (lpString=".xls") returned 4 [0270.877] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0270.877] lstrlenW (lpString=".xlsx") returned 5 [0270.877] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0270.877] lstrlenW (lpString=".ppt") returned 4 [0270.877] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0270.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.877] lstrlenW (lpString=".zip") returned 4 [0270.877] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0270.877] lstrlenW (lpString=".rar") returned 4 [0270.877] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0270.877] lstrlenW (lpString=".bz2") returned 4 [0270.877] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0270.877] lstrlenW (lpString=".7z") returned 3 [0270.877] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0270.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.877] lstrlenW (lpString=".dbf") returned 4 [0270.877] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0270.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.877] lstrlenW (lpString=".1cd") returned 4 [0270.877] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0270.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0270.877] lstrlenW (lpString=".jpg") returned 4 [0270.877] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0270.877] lstrcmpiW (lpString1=".htm", lpString2=".drweb") returned 1 [0270.878] lstrlenW (lpString="Hand Prints.htm") returned 15 [0270.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.898] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=235) returned 1 [0270.898] CloseHandle (hObject=0x174) returned 1 [0270.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0270.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0270.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0270.898] lstrlenW (lpString=".doc") returned 4 [0270.898] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.898] lstrlenW (lpString=".docx") returned 5 [0270.898] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.898] lstrlenW (lpString=".pdf") returned 4 [0270.898] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.898] lstrlenW (lpString=".xls") returned 4 [0270.898] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.898] lstrlenW (lpString=".xlsx") returned 5 [0270.899] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.899] lstrlenW (lpString=".ppt") returned 4 [0270.899] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0270.899] lstrlenW (lpString=".zip") returned 4 [0270.899] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.899] lstrlenW (lpString=".rar") returned 4 [0270.899] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.899] lstrlenW (lpString=".bz2") returned 4 [0270.899] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.899] lstrlenW (lpString=".7z") returned 3 [0270.899] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0270.899] lstrlenW (lpString=".dbf") returned 4 [0270.899] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0271.723] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=19780) returned 1 [0271.723] CloseHandle (hObject=0x174) returned 1 [0271.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0271.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0271.724] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.724] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0271.725] GetLastError () returned 0x0 [0271.725] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0271.793] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0271.795] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.795] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.795] SetEndOfFile (hFile=0x1f4) returned 1 [0271.795] CloseHandle (hObject=0x1f4) returned 1 [0271.795] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.795] SetEndOfFile (hFile=0x174) returned 1 [0271.796] CloseHandle (hObject=0x174) returned 1 [0271.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.797] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0271.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.797] lstrlenW (lpString=".doc") returned 4 [0271.797] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.797] lstrlenW (lpString=".docx") returned 5 [0271.797] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.797] lstrlenW (lpString=".pdf") returned 4 [0271.797] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.797] lstrlenW (lpString=".xls") returned 4 [0271.797] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.797] lstrlenW (lpString=".xlsx") returned 5 [0271.797] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.797] lstrlenW (lpString=".ppt") returned 4 [0271.797] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.798] lstrlenW (lpString=".zip") returned 4 [0271.798] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.798] lstrlenW (lpString=".rar") returned 4 [0271.798] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.798] lstrlenW (lpString=".bz2") returned 4 [0271.798] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.798] lstrlenW (lpString=".7z") returned 3 [0271.798] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.798] lstrlenW (lpString=".dbf") returned 4 [0271.798] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.798] lstrlenW (lpString=".1cd") returned 4 [0271.798] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.798] lstrlenW (lpString=".jpg") returned 4 [0271.798] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.798] lstrlenW (lpString=".doc") returned 4 [0271.798] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.798] lstrlenW (lpString=".docx") returned 5 [0271.798] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.798] lstrlenW (lpString=".pdf") returned 4 [0271.798] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.798] lstrlenW (lpString=".xls") returned 4 [0271.798] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.798] lstrlenW (lpString=".xlsx") returned 5 [0271.798] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.799] lstrlenW (lpString=".ppt") returned 4 [0271.799] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.799] lstrlenW (lpString=".zip") returned 4 [0271.799] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.799] lstrlenW (lpString=".rar") returned 4 [0271.799] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.799] lstrlenW (lpString=".bz2") returned 4 [0271.799] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.799] lstrlenW (lpString=".7z") returned 3 [0271.799] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.799] lstrlenW (lpString=".dbf") returned 4 [0271.799] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.799] lstrlenW (lpString=".1cd") returned 4 [0271.799] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0271.799] lstrlenW (lpString=".jpg") returned 4 [0271.799] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.799] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0271.799] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0271.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0271.800] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1560) returned 1 [0271.800] CloseHandle (hObject=0x174) returned 1 [0271.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0271.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0271.800] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.800] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0272.850] GetLastError () returned 0x0 [0272.850] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x618, lpOverlapped=0x0) returned 1 [0273.295] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x620, lpOverlapped=0x0) returned 1 [0273.296] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.296] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.296] SetEndOfFile (hFile=0x1e0) returned 1 [0273.297] CloseHandle (hObject=0x1e0) returned 1 [0273.297] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.297] SetEndOfFile (hFile=0x174) returned 1 [0273.298] CloseHandle (hObject=0x174) returned 1 [0273.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0273.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.299] lstrlenW (lpString=".doc") returned 4 [0273.299] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.299] lstrlenW (lpString=".docx") returned 5 [0273.299] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.299] lstrlenW (lpString=".pdf") returned 4 [0273.299] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.299] lstrlenW (lpString=".xls") returned 4 [0273.299] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.299] lstrlenW (lpString=".xlsx") returned 5 [0273.299] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.299] lstrlenW (lpString=".ppt") returned 4 [0273.299] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.299] lstrlenW (lpString=".zip") returned 4 [0273.299] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.300] lstrlenW (lpString=".rar") returned 4 [0273.300] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.300] lstrlenW (lpString=".bz2") returned 4 [0273.300] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.300] lstrlenW (lpString=".7z") returned 3 [0273.300] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.300] lstrlenW (lpString=".dbf") returned 4 [0273.300] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.300] lstrlenW (lpString=".1cd") returned 4 [0273.300] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.300] lstrlenW (lpString=".jpg") returned 4 [0273.300] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.300] lstrlenW (lpString=".doc") returned 4 [0273.300] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.300] lstrlenW (lpString=".docx") returned 5 [0273.300] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.300] lstrlenW (lpString=".pdf") returned 4 [0273.300] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.300] lstrlenW (lpString=".xls") returned 4 [0273.301] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.301] lstrlenW (lpString=".xlsx") returned 5 [0273.301] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.301] lstrlenW (lpString=".ppt") returned 4 [0273.301] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.301] lstrlenW (lpString=".zip") returned 4 [0273.301] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.301] lstrlenW (lpString=".rar") returned 4 [0273.301] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.301] lstrlenW (lpString=".bz2") returned 4 [0273.301] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.301] lstrlenW (lpString=".7z") returned 3 [0273.301] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.301] lstrlenW (lpString=".dbf") returned 4 [0273.301] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.301] lstrlenW (lpString=".1cd") returned 4 [0273.301] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0273.301] lstrlenW (lpString=".jpg") returned 4 [0273.301] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.302] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0273.302] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0273.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0273.302] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=945) returned 1 [0273.302] CloseHandle (hObject=0x174) returned 1 [0273.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0273.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0273.303] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.303] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0273.746] GetLastError () returned 0x0 [0273.746] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0273.910] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0273.911] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.911] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.911] SetEndOfFile (hFile=0x204) returned 1 [0273.911] CloseHandle (hObject=0x204) returned 1 [0273.911] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.911] SetEndOfFile (hFile=0x174) returned 1 [0273.912] CloseHandle (hObject=0x174) returned 1 [0273.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0273.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.913] lstrlenW (lpString=".doc") returned 4 [0273.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.913] lstrlenW (lpString=".docx") returned 5 [0273.913] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.913] lstrlenW (lpString=".pdf") returned 4 [0273.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.913] lstrlenW (lpString=".xls") returned 4 [0273.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.913] lstrlenW (lpString=".xlsx") returned 5 [0273.913] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.913] lstrlenW (lpString=".ppt") returned 4 [0273.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.913] lstrlenW (lpString=".zip") returned 4 [0273.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.914] lstrlenW (lpString=".rar") returned 4 [0273.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.914] lstrlenW (lpString=".bz2") returned 4 [0273.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.914] lstrlenW (lpString=".7z") returned 3 [0273.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.914] lstrlenW (lpString=".dbf") returned 4 [0273.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.914] lstrlenW (lpString=".1cd") returned 4 [0273.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.914] lstrlenW (lpString=".jpg") returned 4 [0273.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.915] lstrlenW (lpString=".doc") returned 4 [0273.915] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0273.915] lstrlenW (lpString=".docx") returned 5 [0273.915] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0273.915] lstrlenW (lpString=".pdf") returned 4 [0273.915] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0273.915] lstrlenW (lpString=".xls") returned 4 [0273.915] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0273.915] lstrlenW (lpString=".xlsx") returned 5 [0273.915] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0273.915] lstrlenW (lpString=".ppt") returned 4 [0273.915] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.915] lstrlenW (lpString=".zip") returned 4 [0273.915] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0273.915] lstrlenW (lpString=".rar") returned 4 [0273.915] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0273.915] lstrlenW (lpString=".bz2") returned 4 [0273.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0273.915] lstrlenW (lpString=".7z") returned 3 [0273.915] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.915] lstrlenW (lpString=".dbf") returned 4 [0273.915] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.915] lstrlenW (lpString=".1cd") returned 4 [0273.915] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0273.915] lstrlenW (lpString=".jpg") returned 4 [0273.916] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0273.916] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0273.916] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0273.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0273.917] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=20371) returned 1 [0273.917] CloseHandle (hObject=0x174) returned 1 [0273.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0273.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0273.918] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.918] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0273.918] GetLastError () returned 0x0 [0273.918] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0274.080] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0274.082] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.082] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.082] SetEndOfFile (hFile=0x204) returned 1 [0274.082] CloseHandle (hObject=0x204) returned 1 [0274.082] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.082] SetEndOfFile (hFile=0x174) returned 1 [0274.086] CloseHandle (hObject=0x174) returned 1 [0274.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.086] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0274.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.086] lstrlenW (lpString=".doc") returned 4 [0274.087] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.087] lstrlenW (lpString=".docx") returned 5 [0274.087] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.087] lstrlenW (lpString=".pdf") returned 4 [0274.087] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.087] lstrlenW (lpString=".xls") returned 4 [0274.087] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.087] lstrlenW (lpString=".xlsx") returned 5 [0274.087] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.087] lstrlenW (lpString=".ppt") returned 4 [0274.087] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.087] lstrlenW (lpString=".zip") returned 4 [0274.087] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.087] lstrlenW (lpString=".rar") returned 4 [0274.087] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.087] lstrlenW (lpString=".bz2") returned 4 [0274.087] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.087] lstrlenW (lpString=".7z") returned 3 [0274.087] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.087] lstrlenW (lpString=".dbf") returned 4 [0274.087] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.087] lstrlenW (lpString=".1cd") returned 4 [0274.087] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.087] lstrlenW (lpString=".jpg") returned 4 [0274.088] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.088] lstrlenW (lpString=".doc") returned 4 [0274.088] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.088] lstrlenW (lpString=".docx") returned 5 [0274.088] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.088] lstrlenW (lpString=".pdf") returned 4 [0274.088] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.088] lstrlenW (lpString=".xls") returned 4 [0274.088] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.088] lstrlenW (lpString=".xlsx") returned 5 [0274.088] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.088] lstrlenW (lpString=".ppt") returned 4 [0274.088] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.088] lstrlenW (lpString=".zip") returned 4 [0274.088] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.088] lstrlenW (lpString=".rar") returned 4 [0274.088] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.088] lstrlenW (lpString=".bz2") returned 4 [0274.088] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.088] lstrlenW (lpString=".7z") returned 3 [0274.088] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.089] lstrlenW (lpString=".dbf") returned 4 [0274.089] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.089] lstrlenW (lpString=".1cd") returned 4 [0274.089] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0274.089] lstrlenW (lpString=".jpg") returned 4 [0274.089] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.089] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0274.089] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0274.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0274.166] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=20575) returned 1 [0274.166] CloseHandle (hObject=0x174) returned 1 [0274.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0274.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0274.166] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.167] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.167] GetLastError () returned 0x0 [0274.167] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x505f, lpOverlapped=0x0) returned 1 [0274.169] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0274.171] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.171] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.171] SetEndOfFile (hFile=0x204) returned 1 [0274.171] CloseHandle (hObject=0x204) returned 1 [0274.171] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.171] SetEndOfFile (hFile=0x174) returned 1 [0274.172] CloseHandle (hObject=0x174) returned 1 [0274.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.173] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0274.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.173] lstrlenW (lpString=".doc") returned 4 [0274.173] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.173] lstrlenW (lpString=".docx") returned 5 [0274.173] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.173] lstrlenW (lpString=".pdf") returned 4 [0274.173] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.173] lstrlenW (lpString=".xls") returned 4 [0274.173] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.173] lstrlenW (lpString=".xlsx") returned 5 [0274.173] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.174] lstrlenW (lpString=".ppt") returned 4 [0274.174] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.174] lstrlenW (lpString=".zip") returned 4 [0274.174] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.174] lstrlenW (lpString=".rar") returned 4 [0274.174] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.174] lstrlenW (lpString=".bz2") returned 4 [0274.174] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.174] lstrlenW (lpString=".7z") returned 3 [0274.174] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.174] lstrlenW (lpString=".dbf") returned 4 [0274.174] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.174] lstrlenW (lpString=".1cd") returned 4 [0274.174] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.174] lstrlenW (lpString=".jpg") returned 4 [0274.174] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.175] lstrlenW (lpString=".doc") returned 4 [0274.175] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.175] lstrlenW (lpString=".docx") returned 5 [0274.175] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.175] lstrlenW (lpString=".pdf") returned 4 [0274.175] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.175] lstrlenW (lpString=".xls") returned 4 [0274.175] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.175] lstrlenW (lpString=".xlsx") returned 5 [0274.175] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.175] lstrlenW (lpString=".ppt") returned 4 [0274.175] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.175] lstrlenW (lpString=".zip") returned 4 [0274.175] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.175] lstrlenW (lpString=".rar") returned 4 [0274.175] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.175] lstrlenW (lpString=".bz2") returned 4 [0274.175] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.175] lstrlenW (lpString=".7z") returned 3 [0274.175] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.175] lstrlenW (lpString=".dbf") returned 4 [0274.175] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.176] lstrlenW (lpString=".1cd") returned 4 [0274.176] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0274.176] lstrlenW (lpString=".jpg") returned 4 [0274.176] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.176] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0274.176] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0274.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0274.176] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1287) returned 1 [0274.176] CloseHandle (hObject=0x174) returned 1 [0274.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0274.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0274.177] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.177] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.361] GetLastError () returned 0x0 [0274.361] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x507, lpOverlapped=0x0) returned 1 [0274.455] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x510, lpOverlapped=0x0) returned 1 [0274.456] ReadFile (in: hFile=0x174, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.456] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.456] SetEndOfFile (hFile=0x204) returned 1 [0274.456] CloseHandle (hObject=0x204) returned 1 [0274.457] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.457] SetEndOfFile (hFile=0x174) returned 1 [0274.457] CloseHandle (hObject=0x174) returned 1 [0274.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.458] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0274.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.458] lstrlenW (lpString=".doc") returned 4 [0274.458] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.458] lstrlenW (lpString=".docx") returned 5 [0274.458] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.458] lstrlenW (lpString=".pdf") returned 4 [0274.458] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.458] lstrlenW (lpString=".xls") returned 4 [0274.458] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.458] lstrlenW (lpString=".xlsx") returned 5 [0274.458] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.458] lstrlenW (lpString=".ppt") returned 4 [0274.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.458] lstrlenW (lpString=".zip") returned 4 [0274.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.458] lstrlenW (lpString=".rar") returned 4 [0274.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString=".bz2") returned 4 [0274.459] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.459] lstrlenW (lpString=".7z") returned 3 [0274.459] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.459] lstrlenW (lpString=".dbf") returned 4 [0274.459] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.459] lstrlenW (lpString=".1cd") returned 4 [0274.459] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.459] lstrlenW (lpString=".jpg") returned 4 [0274.459] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.459] lstrlenW (lpString=".doc") returned 4 [0274.459] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0274.459] lstrlenW (lpString=".docx") returned 5 [0274.459] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0274.459] lstrlenW (lpString=".pdf") returned 4 [0274.459] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString=".xls") returned 4 [0274.459] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString=".xlsx") returned 5 [0274.459] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0274.459] lstrlenW (lpString=".ppt") returned 4 [0274.459] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.459] lstrlenW (lpString=".zip") returned 4 [0274.459] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString=".rar") returned 4 [0274.459] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0274.459] lstrlenW (lpString=".bz2") returned 4 [0274.459] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0274.459] lstrlenW (lpString=".7z") returned 3 [0274.460] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.460] lstrlenW (lpString=".dbf") returned 4 [0274.460] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.460] lstrlenW (lpString=".1cd") returned 4 [0274.460] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0274.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0274.460] lstrlenW (lpString=".jpg") returned 4 [0274.460] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0274.460] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0274.460] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0274.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.595] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=33277) returned 1 [0274.595] CloseHandle (hObject=0x204) returned 1 [0274.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0274.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.596] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.596] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0274.596] GetLastError () returned 0x0 [0274.596] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0274.598] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0274.600] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.600] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.600] SetEndOfFile (hFile=0x1c4) returned 1 [0274.600] CloseHandle (hObject=0x1c4) returned 1 [0274.601] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.601] SetEndOfFile (hFile=0x204) returned 1 [0274.602] CloseHandle (hObject=0x204) returned 1 [0274.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0274.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.602] lstrlenW (lpString=".doc") returned 4 [0274.603] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.603] lstrlenW (lpString=".docx") returned 5 [0274.603] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.603] lstrlenW (lpString=".pdf") returned 4 [0274.603] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.603] lstrlenW (lpString=".xls") returned 4 [0274.603] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.603] lstrlenW (lpString=".xlsx") returned 5 [0274.603] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.603] lstrlenW (lpString=".ppt") returned 4 [0274.603] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.603] lstrlenW (lpString=".zip") returned 4 [0274.603] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.603] lstrlenW (lpString=".rar") returned 4 [0274.603] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.603] lstrlenW (lpString=".bz2") returned 4 [0274.603] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.603] lstrlenW (lpString=".7z") returned 3 [0274.603] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.604] lstrlenW (lpString=".dbf") returned 4 [0274.604] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.604] lstrlenW (lpString=".1cd") returned 4 [0274.604] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.604] lstrlenW (lpString=".jpg") returned 4 [0274.604] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.604] lstrlenW (lpString=".doc") returned 4 [0274.604] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.604] lstrlenW (lpString=".docx") returned 5 [0274.604] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.604] lstrlenW (lpString=".pdf") returned 4 [0274.604] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.604] lstrlenW (lpString=".xls") returned 4 [0274.604] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.605] lstrlenW (lpString=".xlsx") returned 5 [0274.605] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.605] lstrlenW (lpString=".ppt") returned 4 [0274.605] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.605] lstrlenW (lpString=".zip") returned 4 [0274.605] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.605] lstrlenW (lpString=".rar") returned 4 [0274.605] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.605] lstrlenW (lpString=".bz2") returned 4 [0274.605] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.605] lstrlenW (lpString=".7z") returned 3 [0274.605] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.605] lstrlenW (lpString=".dbf") returned 4 [0274.605] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.605] lstrlenW (lpString=".1cd") returned 4 [0274.605] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0274.605] lstrlenW (lpString=".jpg") returned 4 [0274.605] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.605] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0274.605] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0274.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.606] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=25106) returned 1 [0274.606] CloseHandle (hObject=0x204) returned 1 [0274.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0274.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.606] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.607] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0274.607] GetLastError () returned 0x0 [0274.607] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x6212, lpOverlapped=0x0) returned 1 [0274.609] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0274.610] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.611] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.611] SetEndOfFile (hFile=0x1c4) returned 1 [0274.611] CloseHandle (hObject=0x1c4) returned 1 [0274.611] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.611] SetEndOfFile (hFile=0x204) returned 1 [0274.612] CloseHandle (hObject=0x204) returned 1 [0274.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0274.613] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0274.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.613] lstrlenW (lpString=".doc") returned 4 [0274.613] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.613] lstrlenW (lpString=".docx") returned 5 [0274.613] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.613] lstrlenW (lpString=".pdf") returned 4 [0274.613] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.613] lstrlenW (lpString=".xls") returned 4 [0274.613] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.613] lstrlenW (lpString=".xlsx") returned 5 [0274.613] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.613] lstrlenW (lpString=".ppt") returned 4 [0274.613] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.613] lstrlenW (lpString=".zip") returned 4 [0274.614] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.614] lstrlenW (lpString=".rar") returned 4 [0274.614] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.614] lstrlenW (lpString=".bz2") returned 4 [0274.614] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.614] lstrlenW (lpString=".7z") returned 3 [0274.614] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.614] lstrlenW (lpString=".dbf") returned 4 [0274.614] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.614] lstrlenW (lpString=".1cd") returned 4 [0274.614] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.614] lstrlenW (lpString=".jpg") returned 4 [0274.614] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.614] lstrlenW (lpString=".doc") returned 4 [0274.614] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0274.614] lstrlenW (lpString=".docx") returned 5 [0274.614] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0274.614] lstrlenW (lpString=".pdf") returned 4 [0274.614] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0274.614] lstrlenW (lpString=".xls") returned 4 [0274.614] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0274.615] lstrlenW (lpString=".xlsx") returned 5 [0274.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0274.615] lstrlenW (lpString=".ppt") returned 4 [0274.615] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0274.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.615] lstrlenW (lpString=".zip") returned 4 [0274.615] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0274.615] lstrlenW (lpString=".rar") returned 4 [0274.615] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0274.615] lstrlenW (lpString=".bz2") returned 4 [0274.615] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0274.615] lstrlenW (lpString=".7z") returned 3 [0274.615] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0274.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.615] lstrlenW (lpString=".dbf") returned 4 [0274.615] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0274.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.615] lstrlenW (lpString=".1cd") returned 4 [0274.615] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0274.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0274.615] lstrlenW (lpString=".jpg") returned 4 [0274.615] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0274.615] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0274.616] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0274.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.617] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1347) returned 1 [0274.617] CloseHandle (hObject=0x204) returned 1 [0274.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0274.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0274.617] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.617] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0274.727] GetLastError () returned 0x0 [0274.727] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x543, lpOverlapped=0x0) returned 1 [0275.324] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x550, lpOverlapped=0x0) returned 1 [0275.326] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.326] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0275.326] SetEndOfFile (hFile=0x1c4) returned 1 [0275.326] CloseHandle (hObject=0x1c4) returned 1 [0275.326] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.326] SetEndOfFile (hFile=0x204) returned 1 [0275.327] CloseHandle (hObject=0x204) returned 1 [0275.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0275.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.328] lstrlenW (lpString=".doc") returned 4 [0275.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.328] lstrlenW (lpString=".docx") returned 5 [0275.328] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.328] lstrlenW (lpString=".pdf") returned 4 [0275.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.328] lstrlenW (lpString=".xls") returned 4 [0275.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.328] lstrlenW (lpString=".xlsx") returned 5 [0275.328] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.328] lstrlenW (lpString=".ppt") returned 4 [0275.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.328] lstrlenW (lpString=".zip") returned 4 [0275.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.328] lstrlenW (lpString=".rar") returned 4 [0275.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.328] lstrlenW (lpString=".bz2") returned 4 [0275.328] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.328] lstrlenW (lpString=".7z") returned 3 [0275.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.329] lstrlenW (lpString=".dbf") returned 4 [0275.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.329] lstrlenW (lpString=".1cd") returned 4 [0275.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.329] lstrlenW (lpString=".jpg") returned 4 [0275.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.329] lstrlenW (lpString=".doc") returned 4 [0275.329] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0275.329] lstrlenW (lpString=".docx") returned 5 [0275.329] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0275.329] lstrlenW (lpString=".pdf") returned 4 [0275.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0275.329] lstrlenW (lpString=".xls") returned 4 [0275.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0275.329] lstrlenW (lpString=".xlsx") returned 5 [0275.329] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0275.329] lstrlenW (lpString=".ppt") returned 4 [0275.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0275.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.329] lstrlenW (lpString=".zip") returned 4 [0275.330] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0275.330] lstrlenW (lpString=".rar") returned 4 [0275.330] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0275.330] lstrlenW (lpString=".bz2") returned 4 [0275.330] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0275.330] lstrlenW (lpString=".7z") returned 3 [0275.330] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0275.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.330] lstrlenW (lpString=".dbf") returned 4 [0275.330] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0275.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.330] lstrlenW (lpString=".1cd") returned 4 [0275.330] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0275.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0275.330] lstrlenW (lpString=".jpg") returned 4 [0275.330] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0275.330] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0275.330] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0275.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0275.581] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=32433) returned 1 [0275.582] CloseHandle (hObject=0x204) returned 1 [0275.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0275.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0275.582] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.582] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0275.582] GetLastError () returned 0x0 [0275.582] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0275.584] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0275.585] ReadFile (in: hFile=0x204, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.585] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.585] SetEndOfFile (hFile=0x1c4) returned 1 [0275.585] CloseHandle (hObject=0x1c4) returned 1 [0275.585] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.585] SetEndOfFile (hFile=0x204) returned 1 [0275.586] CloseHandle (hObject=0x204) returned 1 [0275.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.587] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0275.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.587] lstrlenW (lpString=".doc") returned 4 [0275.587] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.587] lstrlenW (lpString=".docx") returned 5 [0275.587] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.587] lstrlenW (lpString=".pdf") returned 4 [0275.587] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.587] lstrlenW (lpString=".xls") returned 4 [0275.587] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.587] lstrlenW (lpString=".xlsx") returned 5 [0275.587] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.587] lstrlenW (lpString=".ppt") returned 4 [0275.587] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.587] lstrlenW (lpString=".zip") returned 4 [0275.587] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.587] lstrlenW (lpString=".rar") returned 4 [0275.587] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.587] lstrlenW (lpString=".bz2") returned 4 [0275.587] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.587] lstrlenW (lpString=".7z") returned 3 [0275.587] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.587] lstrlenW (lpString=".dbf") returned 4 [0275.587] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.587] lstrlenW (lpString=".1cd") returned 4 [0275.587] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString=".jpg") returned 4 [0275.588] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString=".doc") returned 4 [0275.588] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString=".docx") returned 5 [0275.588] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.588] lstrlenW (lpString=".pdf") returned 4 [0275.588] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString=".xls") returned 4 [0275.588] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.588] lstrlenW (lpString=".xlsx") returned 5 [0275.588] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.588] lstrlenW (lpString=".ppt") returned 4 [0275.588] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString=".zip") returned 4 [0275.588] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.588] lstrlenW (lpString=".rar") returned 4 [0275.588] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.588] lstrlenW (lpString=".bz2") returned 4 [0275.588] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString=".7z") returned 3 [0275.588] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString=".dbf") returned 4 [0275.588] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString=".1cd") returned 4 [0275.588] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0275.588] lstrlenW (lpString=".jpg") returned 4 [0275.588] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.589] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0275.589] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0275.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0275.628] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=60724) returned 1 [0275.629] CloseHandle (hObject=0x1c4) returned 1 [0275.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0275.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0275.629] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.629] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0275.630] GetLastError () returned 0x0 [0275.630] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xed34, lpOverlapped=0x0) returned 1 [0275.633] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0275.634] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.635] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.635] SetEndOfFile (hFile=0x208) returned 1 [0275.635] CloseHandle (hObject=0x208) returned 1 [0275.635] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.635] SetEndOfFile (hFile=0x1c4) returned 1 [0275.636] CloseHandle (hObject=0x1c4) returned 1 [0275.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.637] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0275.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.637] lstrlenW (lpString=".doc") returned 4 [0275.637] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.637] lstrlenW (lpString=".docx") returned 5 [0275.637] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.637] lstrlenW (lpString=".pdf") returned 4 [0275.637] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.637] lstrlenW (lpString=".xls") returned 4 [0275.637] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.637] lstrlenW (lpString=".xlsx") returned 5 [0275.637] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.637] lstrlenW (lpString=".ppt") returned 4 [0275.637] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.638] lstrlenW (lpString=".zip") returned 4 [0275.638] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.638] lstrlenW (lpString=".rar") returned 4 [0275.638] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.638] lstrlenW (lpString=".bz2") returned 4 [0275.638] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.638] lstrlenW (lpString=".7z") returned 3 [0275.638] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.638] lstrlenW (lpString=".dbf") returned 4 [0275.638] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.638] lstrlenW (lpString=".1cd") returned 4 [0275.638] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.638] lstrlenW (lpString=".jpg") returned 4 [0275.638] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.638] lstrlenW (lpString=".doc") returned 4 [0275.638] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.638] lstrlenW (lpString=".docx") returned 5 [0275.638] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.638] lstrlenW (lpString=".pdf") returned 4 [0275.638] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.638] lstrlenW (lpString=".xls") returned 4 [0275.639] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.639] lstrlenW (lpString=".xlsx") returned 5 [0275.639] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.639] lstrlenW (lpString=".ppt") returned 4 [0275.639] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.639] lstrlenW (lpString=".zip") returned 4 [0275.639] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.639] lstrlenW (lpString=".rar") returned 4 [0275.639] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.639] lstrlenW (lpString=".bz2") returned 4 [0275.639] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.639] lstrlenW (lpString=".7z") returned 3 [0275.639] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.639] lstrlenW (lpString=".dbf") returned 4 [0275.639] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.639] lstrlenW (lpString=".1cd") returned 4 [0275.639] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0275.639] lstrlenW (lpString=".jpg") returned 4 [0275.639] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.640] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0275.640] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0275.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0275.640] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2552) returned 1 [0275.640] CloseHandle (hObject=0x1c4) returned 1 [0275.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0275.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0275.641] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.641] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0276.080] GetLastError () returned 0x0 [0276.080] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0277.960] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0277.966] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0277.967] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0277.967] SetEndOfFile (hFile=0x1f0) returned 1 [0277.967] CloseHandle (hObject=0x1f0) returned 1 [0277.967] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.967] SetEndOfFile (hFile=0x1c4) returned 1 [0278.199] CloseHandle (hObject=0x1c4) returned 1 [0278.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.199] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0278.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.200] lstrlenW (lpString=".doc") returned 4 [0278.200] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.200] lstrlenW (lpString=".docx") returned 5 [0278.200] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.200] lstrlenW (lpString=".pdf") returned 4 [0278.200] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.200] lstrlenW (lpString=".xls") returned 4 [0278.200] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.200] lstrlenW (lpString=".xlsx") returned 5 [0278.200] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.200] lstrlenW (lpString=".ppt") returned 4 [0278.200] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.200] lstrlenW (lpString=".zip") returned 4 [0278.200] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.200] lstrlenW (lpString=".rar") returned 4 [0278.200] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.200] lstrlenW (lpString=".bz2") returned 4 [0278.200] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.200] lstrlenW (lpString=".7z") returned 3 [0278.200] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.201] lstrlenW (lpString=".dbf") returned 4 [0278.201] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.201] lstrlenW (lpString=".1cd") returned 4 [0278.201] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.201] lstrlenW (lpString=".jpg") returned 4 [0278.201] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.201] lstrlenW (lpString=".doc") returned 4 [0278.201] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.201] lstrlenW (lpString=".docx") returned 5 [0278.201] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.201] lstrlenW (lpString=".pdf") returned 4 [0278.201] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.201] lstrlenW (lpString=".xls") returned 4 [0278.201] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.201] lstrlenW (lpString=".xlsx") returned 5 [0278.201] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.201] lstrlenW (lpString=".ppt") returned 4 [0278.201] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.201] lstrlenW (lpString=".zip") returned 4 [0278.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.202] lstrlenW (lpString=".rar") returned 4 [0278.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.202] lstrlenW (lpString=".bz2") returned 4 [0278.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.202] lstrlenW (lpString=".7z") returned 3 [0278.202] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.202] lstrlenW (lpString=".dbf") returned 4 [0278.202] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.202] lstrlenW (lpString=".1cd") returned 4 [0278.202] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0278.202] lstrlenW (lpString=".jpg") returned 4 [0278.202] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.202] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0278.202] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0278.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.631] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=48115) returned 1 [0278.631] CloseHandle (hObject=0x1e0) returned 1 [0278.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0278.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.632] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.632] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.632] GetLastError () returned 0x0 [0278.632] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0278.635] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0278.637] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.637] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.637] SetEndOfFile (hFile=0x1c0) returned 1 [0278.637] CloseHandle (hObject=0x1c0) returned 1 [0278.637] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.637] SetEndOfFile (hFile=0x1e0) returned 1 [0278.638] CloseHandle (hObject=0x1e0) returned 1 [0278.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0278.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.639] lstrlenW (lpString=".doc") returned 4 [0278.639] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.639] lstrlenW (lpString=".docx") returned 5 [0278.639] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.639] lstrlenW (lpString=".pdf") returned 4 [0278.639] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.639] lstrlenW (lpString=".xls") returned 4 [0278.639] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.639] lstrlenW (lpString=".xlsx") returned 5 [0278.640] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.640] lstrlenW (lpString=".ppt") returned 4 [0278.640] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.640] lstrlenW (lpString=".zip") returned 4 [0278.640] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.640] lstrlenW (lpString=".rar") returned 4 [0278.640] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.640] lstrlenW (lpString=".bz2") returned 4 [0278.640] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.640] lstrlenW (lpString=".7z") returned 3 [0278.640] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.640] lstrlenW (lpString=".dbf") returned 4 [0278.640] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.640] lstrlenW (lpString=".1cd") returned 4 [0278.640] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.640] lstrlenW (lpString=".jpg") returned 4 [0278.640] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.640] lstrlenW (lpString=".doc") returned 4 [0278.640] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.640] lstrlenW (lpString=".docx") returned 5 [0278.640] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.641] lstrlenW (lpString=".pdf") returned 4 [0278.641] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.641] lstrlenW (lpString=".xls") returned 4 [0278.641] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.641] lstrlenW (lpString=".xlsx") returned 5 [0278.641] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.641] lstrlenW (lpString=".ppt") returned 4 [0278.641] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.641] lstrlenW (lpString=".zip") returned 4 [0278.641] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.641] lstrlenW (lpString=".rar") returned 4 [0278.641] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.641] lstrlenW (lpString=".bz2") returned 4 [0278.641] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.641] lstrlenW (lpString=".7z") returned 3 [0278.641] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.641] lstrlenW (lpString=".dbf") returned 4 [0278.641] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.641] lstrlenW (lpString=".1cd") returned 4 [0278.641] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0278.641] lstrlenW (lpString=".jpg") returned 4 [0278.641] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.642] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0278.642] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0278.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.642] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1593) returned 1 [0278.642] CloseHandle (hObject=0x1e0) returned 1 [0278.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0278.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0278.643] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.643] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0278.674] GetLastError () returned 0x0 [0278.674] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x639, lpOverlapped=0x0) returned 1 [0278.691] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x640, lpOverlapped=0x0) returned 1 [0278.692] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.692] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.692] SetEndOfFile (hFile=0x1b0) returned 1 [0278.693] CloseHandle (hObject=0x1b0) returned 1 [0278.693] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.693] SetEndOfFile (hFile=0x1e0) returned 1 [0278.694] CloseHandle (hObject=0x1e0) returned 1 [0278.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0278.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.694] lstrlenW (lpString=".doc") returned 4 [0278.694] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.694] lstrlenW (lpString=".docx") returned 5 [0278.694] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.694] lstrlenW (lpString=".pdf") returned 4 [0278.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.695] lstrlenW (lpString=".xls") returned 4 [0278.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.695] lstrlenW (lpString=".xlsx") returned 5 [0278.695] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.695] lstrlenW (lpString=".ppt") returned 4 [0278.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.695] lstrlenW (lpString=".zip") returned 4 [0278.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.695] lstrlenW (lpString=".rar") returned 4 [0278.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.695] lstrlenW (lpString=".bz2") returned 4 [0278.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.695] lstrlenW (lpString=".7z") returned 3 [0278.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.695] lstrlenW (lpString=".dbf") returned 4 [0278.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.695] lstrlenW (lpString=".1cd") returned 4 [0278.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.695] lstrlenW (lpString=".jpg") returned 4 [0278.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.695] lstrlenW (lpString=".doc") returned 4 [0278.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.696] lstrlenW (lpString=".docx") returned 5 [0278.696] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.696] lstrlenW (lpString=".pdf") returned 4 [0278.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.696] lstrlenW (lpString=".xls") returned 4 [0278.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.696] lstrlenW (lpString=".xlsx") returned 5 [0278.696] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.696] lstrlenW (lpString=".ppt") returned 4 [0278.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.698] lstrlenW (lpString=".zip") returned 4 [0278.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.699] lstrlenW (lpString=".rar") returned 4 [0278.699] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.699] lstrlenW (lpString=".bz2") returned 4 [0278.699] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.699] lstrlenW (lpString=".7z") returned 3 [0278.699] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.699] lstrlenW (lpString=".dbf") returned 4 [0278.699] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.699] lstrlenW (lpString=".1cd") returned 4 [0278.699] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0278.699] lstrlenW (lpString=".jpg") returned 4 [0278.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.700] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0278.700] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0278.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0278.874] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=21745) returned 1 [0278.874] CloseHandle (hObject=0x1f8) returned 1 [0278.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0278.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0278.874] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.875] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0278.875] GetLastError () returned 0x0 [0278.875] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0278.913] WriteFile (in: hFile=0x200, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0278.914] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.914] WriteFile (in: hFile=0x200, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.914] SetEndOfFile (hFile=0x200) returned 1 [0278.915] CloseHandle (hObject=0x200) returned 1 [0278.915] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.915] SetEndOfFile (hFile=0x1f8) returned 1 [0278.918] CloseHandle (hObject=0x1f8) returned 1 [0278.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0278.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.919] lstrlenW (lpString=".doc") returned 4 [0278.919] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.919] lstrlenW (lpString=".docx") returned 5 [0278.919] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.919] lstrlenW (lpString=".pdf") returned 4 [0278.919] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.919] lstrlenW (lpString=".xls") returned 4 [0278.919] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.919] lstrlenW (lpString=".xlsx") returned 5 [0278.919] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.919] lstrlenW (lpString=".ppt") returned 4 [0278.919] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.919] lstrlenW (lpString=".zip") returned 4 [0278.919] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.919] lstrlenW (lpString=".rar") returned 4 [0278.919] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.919] lstrlenW (lpString=".bz2") returned 4 [0278.919] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.919] lstrlenW (lpString=".7z") returned 3 [0278.919] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.920] lstrlenW (lpString=".dbf") returned 4 [0278.920] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.920] lstrlenW (lpString=".1cd") returned 4 [0278.920] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.920] lstrlenW (lpString=".jpg") returned 4 [0278.920] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.920] lstrlenW (lpString=".doc") returned 4 [0278.920] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.920] lstrlenW (lpString=".docx") returned 5 [0278.920] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.920] lstrlenW (lpString=".pdf") returned 4 [0278.920] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.920] lstrlenW (lpString=".xls") returned 4 [0278.920] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.920] lstrlenW (lpString=".xlsx") returned 5 [0278.920] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.920] lstrlenW (lpString=".ppt") returned 4 [0278.920] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.920] lstrlenW (lpString=".zip") returned 4 [0278.921] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.921] lstrlenW (lpString=".rar") returned 4 [0278.921] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.921] lstrlenW (lpString=".bz2") returned 4 [0278.921] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.921] lstrlenW (lpString=".7z") returned 3 [0278.921] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.921] lstrlenW (lpString=".dbf") returned 4 [0278.921] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.921] lstrlenW (lpString=".1cd") returned 4 [0278.921] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0278.921] lstrlenW (lpString=".jpg") returned 4 [0278.921] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.921] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0278.921] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0278.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0278.922] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1339) returned 1 [0278.922] CloseHandle (hObject=0x1f8) returned 1 [0278.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0278.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0278.922] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.923] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0278.932] GetLastError () returned 0x0 [0278.944] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x53b, lpOverlapped=0x0) returned 1 [0279.067] WriteFile (in: hFile=0x200, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x540, lpOverlapped=0x0) returned 1 [0279.068] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.068] WriteFile (in: hFile=0x200, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.068] SetEndOfFile (hFile=0x200) returned 1 [0279.068] CloseHandle (hObject=0x200) returned 1 [0279.069] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.069] SetEndOfFile (hFile=0x1f8) returned 1 [0279.069] CloseHandle (hObject=0x1f8) returned 1 [0279.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0279.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.070] lstrlenW (lpString=".doc") returned 4 [0279.070] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.070] lstrlenW (lpString=".docx") returned 5 [0279.070] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.070] lstrlenW (lpString=".pdf") returned 4 [0279.070] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.070] lstrlenW (lpString=".xls") returned 4 [0279.070] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.071] lstrlenW (lpString=".xlsx") returned 5 [0279.071] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.071] lstrlenW (lpString=".ppt") returned 4 [0279.071] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.071] lstrlenW (lpString=".zip") returned 4 [0279.071] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.071] lstrlenW (lpString=".rar") returned 4 [0279.071] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.071] lstrlenW (lpString=".bz2") returned 4 [0279.071] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.071] lstrlenW (lpString=".7z") returned 3 [0279.071] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.071] lstrlenW (lpString=".dbf") returned 4 [0279.071] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.071] lstrlenW (lpString=".1cd") returned 4 [0279.071] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.071] lstrlenW (lpString=".jpg") returned 4 [0279.071] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.071] lstrlenW (lpString=".doc") returned 4 [0279.071] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.071] lstrlenW (lpString=".docx") returned 5 [0279.072] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.072] lstrlenW (lpString=".pdf") returned 4 [0279.072] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.072] lstrlenW (lpString=".xls") returned 4 [0279.072] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.072] lstrlenW (lpString=".xlsx") returned 5 [0279.072] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.072] lstrlenW (lpString=".ppt") returned 4 [0279.072] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.072] lstrlenW (lpString=".zip") returned 4 [0279.072] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.072] lstrlenW (lpString=".rar") returned 4 [0279.072] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.072] lstrlenW (lpString=".bz2") returned 4 [0279.072] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.072] lstrlenW (lpString=".7z") returned 3 [0279.072] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.072] lstrlenW (lpString=".dbf") returned 4 [0279.072] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.073] lstrlenW (lpString=".1cd") returned 4 [0279.073] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0279.073] lstrlenW (lpString=".jpg") returned 4 [0279.073] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.156] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0279.157] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0279.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0279.157] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1439) returned 1 [0279.157] CloseHandle (hObject=0x1f8) returned 1 [0279.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0279.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0279.157] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.158] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0279.170] GetLastError () returned 0x0 [0279.171] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x59f, lpOverlapped=0x0) returned 1 [0279.192] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0279.193] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.193] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.194] SetEndOfFile (hFile=0x1c4) returned 1 [0279.194] CloseHandle (hObject=0x1c4) returned 1 [0279.194] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.194] SetEndOfFile (hFile=0x1f8) returned 1 [0279.195] CloseHandle (hObject=0x1f8) returned 1 [0279.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.195] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0279.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.195] lstrlenW (lpString=".doc") returned 4 [0279.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.195] lstrlenW (lpString=".docx") returned 5 [0279.196] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.196] lstrlenW (lpString=".pdf") returned 4 [0279.196] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.196] lstrlenW (lpString=".xls") returned 4 [0279.196] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.196] lstrlenW (lpString=".xlsx") returned 5 [0279.196] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.196] lstrlenW (lpString=".ppt") returned 4 [0279.196] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.196] lstrlenW (lpString=".zip") returned 4 [0279.196] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.196] lstrlenW (lpString=".rar") returned 4 [0279.196] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.196] lstrlenW (lpString=".bz2") returned 4 [0279.196] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.196] lstrlenW (lpString=".7z") returned 3 [0279.196] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.196] lstrlenW (lpString=".dbf") returned 4 [0279.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.196] lstrlenW (lpString=".1cd") returned 4 [0279.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.196] lstrlenW (lpString=".jpg") returned 4 [0279.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.197] lstrlenW (lpString=".doc") returned 4 [0279.197] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.197] lstrlenW (lpString=".docx") returned 5 [0279.197] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.197] lstrlenW (lpString=".pdf") returned 4 [0279.197] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.197] lstrlenW (lpString=".xls") returned 4 [0279.197] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.197] lstrlenW (lpString=".xlsx") returned 5 [0279.197] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.197] lstrlenW (lpString=".ppt") returned 4 [0279.197] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.197] lstrlenW (lpString=".zip") returned 4 [0279.197] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.197] lstrlenW (lpString=".rar") returned 4 [0279.197] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.197] lstrlenW (lpString=".bz2") returned 4 [0279.198] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.198] lstrlenW (lpString=".7z") returned 3 [0279.198] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.198] lstrlenW (lpString=".dbf") returned 4 [0279.198] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.198] lstrlenW (lpString=".1cd") returned 4 [0279.198] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0279.198] lstrlenW (lpString=".jpg") returned 4 [0279.198] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.199] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0279.199] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0279.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0279.203] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=19563) returned 1 [0279.203] CloseHandle (hObject=0x1f8) returned 1 [0279.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0279.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0279.204] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.204] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0279.260] GetLastError () returned 0x0 [0279.260] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0279.376] WriteFile (in: hFile=0x200, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0279.378] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.378] WriteFile (in: hFile=0x200, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.378] SetEndOfFile (hFile=0x200) returned 1 [0279.378] CloseHandle (hObject=0x200) returned 1 [0279.378] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.378] SetEndOfFile (hFile=0x1f8) returned 1 [0279.379] CloseHandle (hObject=0x1f8) returned 1 [0279.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0279.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.380] lstrlenW (lpString=".doc") returned 4 [0279.380] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.380] lstrlenW (lpString=".docx") returned 5 [0279.380] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.380] lstrlenW (lpString=".pdf") returned 4 [0279.380] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.380] lstrlenW (lpString=".xls") returned 4 [0279.380] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.380] lstrlenW (lpString=".xlsx") returned 5 [0279.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.380] lstrlenW (lpString=".ppt") returned 4 [0279.380] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.380] lstrlenW (lpString=".zip") returned 4 [0279.381] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.381] lstrlenW (lpString=".rar") returned 4 [0279.381] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.381] lstrlenW (lpString=".bz2") returned 4 [0279.381] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.381] lstrlenW (lpString=".7z") returned 3 [0279.381] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.381] lstrlenW (lpString=".dbf") returned 4 [0279.381] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.381] lstrlenW (lpString=".1cd") returned 4 [0279.381] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.381] lstrlenW (lpString=".jpg") returned 4 [0279.381] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.381] lstrlenW (lpString=".doc") returned 4 [0279.381] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.381] lstrlenW (lpString=".docx") returned 5 [0279.381] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.381] lstrlenW (lpString=".pdf") returned 4 [0279.381] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.381] lstrlenW (lpString=".xls") returned 4 [0279.381] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.382] lstrlenW (lpString=".xlsx") returned 5 [0279.382] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.382] lstrlenW (lpString=".ppt") returned 4 [0279.382] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.382] lstrlenW (lpString=".zip") returned 4 [0279.382] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.382] lstrlenW (lpString=".rar") returned 4 [0279.382] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.382] lstrlenW (lpString=".bz2") returned 4 [0279.382] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.382] lstrlenW (lpString=".7z") returned 3 [0279.382] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.382] lstrlenW (lpString=".dbf") returned 4 [0279.382] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.382] lstrlenW (lpString=".1cd") returned 4 [0279.382] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0279.382] lstrlenW (lpString=".jpg") returned 4 [0279.382] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.382] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0279.383] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0279.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.392] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=53115) returned 1 [0279.392] CloseHandle (hObject=0x214) returned 1 [0279.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0279.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.392] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.392] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0279.393] GetLastError () returned 0x0 [0279.393] ReadFile (in: hFile=0x214, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0279.540] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0279.542] ReadFile (in: hFile=0x214, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.542] WriteFile (in: hFile=0x210, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.543] SetEndOfFile (hFile=0x210) returned 1 [0279.543] CloseHandle (hObject=0x210) returned 1 [0279.543] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.543] SetEndOfFile (hFile=0x214) returned 1 [0279.544] CloseHandle (hObject=0x214) returned 1 [0279.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.545] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0279.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.545] lstrlenW (lpString=".doc") returned 4 [0279.545] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.545] lstrlenW (lpString=".docx") returned 5 [0279.545] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.545] lstrlenW (lpString=".pdf") returned 4 [0279.545] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.545] lstrlenW (lpString=".xls") returned 4 [0279.545] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.545] lstrlenW (lpString=".xlsx") returned 5 [0279.545] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.545] lstrlenW (lpString=".ppt") returned 4 [0279.546] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.546] lstrlenW (lpString=".zip") returned 4 [0279.546] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.546] lstrlenW (lpString=".rar") returned 4 [0279.546] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.546] lstrlenW (lpString=".bz2") returned 4 [0279.546] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.546] lstrlenW (lpString=".7z") returned 3 [0279.546] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.546] lstrlenW (lpString=".dbf") returned 4 [0279.546] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.546] lstrlenW (lpString=".1cd") returned 4 [0279.546] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.546] lstrlenW (lpString=".jpg") returned 4 [0279.546] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.546] lstrlenW (lpString=".doc") returned 4 [0279.546] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.546] lstrlenW (lpString=".docx") returned 5 [0279.546] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.547] lstrlenW (lpString=".pdf") returned 4 [0279.547] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.547] lstrlenW (lpString=".xls") returned 4 [0279.547] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.547] lstrlenW (lpString=".xlsx") returned 5 [0279.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.547] lstrlenW (lpString=".ppt") returned 4 [0279.547] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.547] lstrlenW (lpString=".zip") returned 4 [0279.547] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.547] lstrlenW (lpString=".rar") returned 4 [0279.547] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.547] lstrlenW (lpString=".bz2") returned 4 [0279.547] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.547] lstrlenW (lpString=".7z") returned 3 [0279.547] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.547] lstrlenW (lpString=".dbf") returned 4 [0279.547] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.548] lstrlenW (lpString=".1cd") returned 4 [0279.548] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0279.548] lstrlenW (lpString=".jpg") returned 4 [0279.548] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.548] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0279.548] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0279.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0279.553] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=47962) returned 1 [0279.553] CloseHandle (hObject=0x210) returned 1 [0279.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0279.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0279.553] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.553] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0279.554] GetLastError () returned 0x0 [0279.554] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0279.701] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0279.703] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.703] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.703] SetEndOfFile (hFile=0x1e4) returned 1 [0279.703] CloseHandle (hObject=0x1e4) returned 1 [0279.703] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.704] SetEndOfFile (hFile=0x210) returned 1 [0279.705] CloseHandle (hObject=0x210) returned 1 [0279.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.705] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0279.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.705] lstrlenW (lpString=".doc") returned 4 [0279.705] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.705] lstrlenW (lpString=".docx") returned 5 [0279.705] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.705] lstrlenW (lpString=".pdf") returned 4 [0279.705] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.705] lstrlenW (lpString=".xls") returned 4 [0279.705] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.706] lstrlenW (lpString=".xlsx") returned 5 [0279.706] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.706] lstrlenW (lpString=".ppt") returned 4 [0279.706] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.706] lstrlenW (lpString=".zip") returned 4 [0279.706] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.706] lstrlenW (lpString=".rar") returned 4 [0279.706] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.706] lstrlenW (lpString=".bz2") returned 4 [0279.706] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.706] lstrlenW (lpString=".7z") returned 3 [0279.706] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.706] lstrlenW (lpString=".dbf") returned 4 [0279.706] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.706] lstrlenW (lpString=".1cd") returned 4 [0279.706] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.706] lstrlenW (lpString=".jpg") returned 4 [0279.706] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.706] lstrlenW (lpString=".doc") returned 4 [0279.706] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0279.706] lstrlenW (lpString=".docx") returned 5 [0279.706] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0279.706] lstrlenW (lpString=".pdf") returned 4 [0279.706] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0279.707] lstrlenW (lpString=".xls") returned 4 [0279.707] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0279.707] lstrlenW (lpString=".xlsx") returned 5 [0279.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0279.707] lstrlenW (lpString=".ppt") returned 4 [0279.707] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0279.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.707] lstrlenW (lpString=".zip") returned 4 [0279.707] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0279.707] lstrlenW (lpString=".rar") returned 4 [0279.707] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0279.707] lstrlenW (lpString=".bz2") returned 4 [0279.707] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0279.707] lstrlenW (lpString=".7z") returned 3 [0279.707] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0279.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.707] lstrlenW (lpString=".dbf") returned 4 [0279.707] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0279.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.707] lstrlenW (lpString=".1cd") returned 4 [0279.707] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0279.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0279.707] lstrlenW (lpString=".jpg") returned 4 [0279.707] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0279.707] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0279.707] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0279.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0280.392] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=34163) returned 1 [0280.392] CloseHandle (hObject=0x1e4) returned 1 [0280.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0280.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0280.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0280.393] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.393] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0280.393] GetLastError () returned 0x0 [0280.393] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x8573, lpOverlapped=0x0) returned 1 [0281.397] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0281.399] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.399] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.399] SetEndOfFile (hFile=0x1c0) returned 1 [0281.399] CloseHandle (hObject=0x1c0) returned 1 [0281.400] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.400] SetEndOfFile (hFile=0x1e4) returned 1 [0281.401] CloseHandle (hObject=0x1e4) returned 1 [0281.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.401] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0281.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.402] lstrlenW (lpString=".doc") returned 4 [0281.402] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.402] lstrlenW (lpString=".docx") returned 5 [0281.402] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.402] lstrlenW (lpString=".pdf") returned 4 [0281.402] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.402] lstrlenW (lpString=".xls") returned 4 [0281.402] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.402] lstrlenW (lpString=".xlsx") returned 5 [0281.402] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.402] lstrlenW (lpString=".ppt") returned 4 [0281.402] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.402] lstrlenW (lpString=".zip") returned 4 [0281.402] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.402] lstrlenW (lpString=".rar") returned 4 [0281.402] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.402] lstrlenW (lpString=".bz2") returned 4 [0281.402] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.402] lstrlenW (lpString=".7z") returned 3 [0281.402] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.402] lstrlenW (lpString=".dbf") returned 4 [0281.402] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.403] lstrlenW (lpString=".1cd") returned 4 [0281.403] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.403] lstrlenW (lpString=".jpg") returned 4 [0281.403] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.403] lstrlenW (lpString=".doc") returned 4 [0281.403] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.403] lstrlenW (lpString=".docx") returned 5 [0281.403] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.403] lstrlenW (lpString=".pdf") returned 4 [0281.403] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.403] lstrlenW (lpString=".xls") returned 4 [0281.403] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.403] lstrlenW (lpString=".xlsx") returned 5 [0281.403] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.403] lstrlenW (lpString=".ppt") returned 4 [0281.403] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.403] lstrlenW (lpString=".zip") returned 4 [0281.403] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.403] lstrlenW (lpString=".rar") returned 4 [0281.403] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.403] lstrlenW (lpString=".bz2") returned 4 [0281.403] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.404] lstrlenW (lpString=".7z") returned 3 [0281.404] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.404] lstrlenW (lpString=".dbf") returned 4 [0281.404] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.404] lstrlenW (lpString=".1cd") returned 4 [0281.404] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0281.404] lstrlenW (lpString=".jpg") returned 4 [0281.404] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.404] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0281.404] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0281.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0281.422] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=27177) returned 1 [0281.422] CloseHandle (hObject=0x1e0) returned 1 [0281.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0281.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0281.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0281.431] GetLastError () returned 0x0 [0281.431] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0281.479] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0281.481] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.481] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.481] SetEndOfFile (hFile=0x1c0) returned 1 [0281.481] CloseHandle (hObject=0x1c0) returned 1 [0281.482] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.482] SetEndOfFile (hFile=0x1e0) returned 1 [0281.483] CloseHandle (hObject=0x1e0) returned 1 [0281.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0281.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.483] lstrlenW (lpString=".doc") returned 4 [0281.484] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.484] lstrlenW (lpString=".docx") returned 5 [0281.484] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.484] lstrlenW (lpString=".pdf") returned 4 [0281.484] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.484] lstrlenW (lpString=".xls") returned 4 [0281.484] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.484] lstrlenW (lpString=".xlsx") returned 5 [0281.484] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.484] lstrlenW (lpString=".ppt") returned 4 [0281.484] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.484] lstrlenW (lpString=".zip") returned 4 [0281.484] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.484] lstrlenW (lpString=".rar") returned 4 [0281.484] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.484] lstrlenW (lpString=".bz2") returned 4 [0281.484] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.484] lstrlenW (lpString=".7z") returned 3 [0281.484] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.484] lstrlenW (lpString=".dbf") returned 4 [0281.484] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.484] lstrlenW (lpString=".1cd") returned 4 [0281.484] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.485] lstrlenW (lpString=".jpg") returned 4 [0281.485] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.485] lstrlenW (lpString=".doc") returned 4 [0281.485] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.485] lstrlenW (lpString=".docx") returned 5 [0281.485] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.485] lstrlenW (lpString=".pdf") returned 4 [0281.485] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.485] lstrlenW (lpString=".xls") returned 4 [0281.485] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.485] lstrlenW (lpString=".xlsx") returned 5 [0281.485] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.485] lstrlenW (lpString=".ppt") returned 4 [0281.485] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.485] lstrlenW (lpString=".zip") returned 4 [0281.485] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.485] lstrlenW (lpString=".rar") returned 4 [0281.485] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.485] lstrlenW (lpString=".bz2") returned 4 [0281.485] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.485] lstrlenW (lpString=".7z") returned 3 [0281.486] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.486] lstrlenW (lpString=".dbf") returned 4 [0281.486] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.486] lstrlenW (lpString=".1cd") returned 4 [0281.486] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0281.486] lstrlenW (lpString=".jpg") returned 4 [0281.486] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.486] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.486] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0281.496] GetLastError () returned 0x0 [0281.496] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0281.781] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0282.055] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.055] WriteFile (in: hFile=0x1e4, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0282.055] SetEndOfFile (hFile=0x1e4) returned 1 [0282.055] CloseHandle (hObject=0x1e4) returned 1 [0282.055] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.055] SetEndOfFile (hFile=0x1e0) returned 1 [0282.056] CloseHandle (hObject=0x1e0) returned 1 [0282.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.056] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0282.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0282.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0282.057] lstrlenW (lpString=".doc") returned 4 [0282.057] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0282.057] lstrlenW (lpString=".docx") returned 5 [0282.057] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0282.057] lstrlenW (lpString=".pdf") returned 4 [0282.057] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0282.057] lstrlenW (lpString=".xls") returned 4 [0282.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0282.057] lstrlenW (lpString=".xlsx") returned 5 [0282.057] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0282.057] lstrlenW (lpString=".ppt") returned 4 [0282.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0282.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0282.057] lstrlenW (lpString=".zip") returned 4 [0282.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0282.057] lstrlenW (lpString=".rar") returned 4 [0282.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0282.057] lstrlenW (lpString=".bz2") returned 4 [0282.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0282.057] lstrlenW (lpString=".7z") returned 3 [0282.057] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0282.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0282.057] lstrlenW (lpString=".dbf") returned 4 [0282.057] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0282.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0282.057] lstrlenW (lpString=".1cd") returned 4 [0282.057] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0282.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0282.057] lstrlenW (lpString=".jpg") returned 4 [0282.057] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0282.250] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.250] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0282.251] GetLastError () returned 0x0 [0282.251] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0282.368] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0282.371] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.371] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0282.371] SetEndOfFile (hFile=0x1c0) returned 1 [0282.371] CloseHandle (hObject=0x1c0) returned 1 [0282.371] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.371] SetEndOfFile (hFile=0x210) returned 1 [0282.373] CloseHandle (hObject=0x210) returned 1 [0282.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0282.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0282.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0282.373] lstrlenW (lpString=".doc") returned 4 [0282.373] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString=".docx") returned 5 [0282.374] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0282.374] lstrlenW (lpString=".pdf") returned 4 [0282.374] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString=".xls") returned 4 [0282.374] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString=".xlsx") returned 5 [0282.374] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0282.374] lstrlenW (lpString=".ppt") returned 4 [0282.374] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0282.374] lstrlenW (lpString=".zip") returned 4 [0282.374] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString=".rar") returned 4 [0282.374] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString=".bz2") returned 4 [0282.374] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.374] lstrlenW (lpString=".7z") returned 3 [0282.374] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0282.374] lstrlenW (lpString=".dbf") returned 4 [0282.374] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0282.374] lstrlenW (lpString=".1cd") returned 4 [0282.374] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0282.374] lstrlenW (lpString=".jpg") returned 4 [0282.375] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.376] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.376] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0282.376] GetLastError () returned 0x0 [0282.376] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0282.440] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0282.451] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.451] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.451] SetEndOfFile (hFile=0x1c0) returned 1 [0282.451] CloseHandle (hObject=0x1c0) returned 1 [0282.451] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.451] SetEndOfFile (hFile=0x210) returned 1 [0282.456] CloseHandle (hObject=0x210) returned 1 [0282.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0282.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0282.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0282.457] lstrlenW (lpString=".doc") returned 4 [0282.457] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.457] lstrlenW (lpString=".docx") returned 5 [0282.457] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.457] lstrlenW (lpString=".pdf") returned 4 [0282.457] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.457] lstrlenW (lpString=".xls") returned 4 [0282.457] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.457] lstrlenW (lpString=".xlsx") returned 5 [0282.457] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.457] lstrlenW (lpString=".ppt") returned 4 [0282.457] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0282.457] lstrlenW (lpString=".zip") returned 4 [0282.457] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.457] lstrlenW (lpString=".rar") returned 4 [0282.458] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.458] lstrlenW (lpString=".bz2") returned 4 [0282.458] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.458] lstrlenW (lpString=".7z") returned 3 [0282.458] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0282.458] lstrlenW (lpString=".dbf") returned 4 [0282.458] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0282.458] lstrlenW (lpString=".1cd") returned 4 [0282.458] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0282.458] lstrlenW (lpString=".jpg") returned 4 [0282.458] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.459] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.459] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0282.459] GetLastError () returned 0x0 [0282.460] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0282.471] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0282.553] ReadFile (in: hFile=0x210, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.553] WriteFile (in: hFile=0x1c0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.553] SetEndOfFile (hFile=0x1c0) returned 1 [0282.553] CloseHandle (hObject=0x1c0) returned 1 [0282.553] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.553] SetEndOfFile (hFile=0x210) returned 1 [0282.555] CloseHandle (hObject=0x210) returned 1 [0282.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.555] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0282.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0282.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0282.556] lstrlenW (lpString=".doc") returned 4 [0282.556] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0282.556] lstrlenW (lpString=".docx") returned 5 [0282.556] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0282.556] lstrlenW (lpString=".pdf") returned 4 [0282.556] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0282.556] lstrlenW (lpString=".xls") returned 4 [0282.556] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0282.556] lstrlenW (lpString=".xlsx") returned 5 [0282.556] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0282.556] lstrlenW (lpString=".ppt") returned 4 [0282.556] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0282.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0282.556] lstrlenW (lpString=".zip") returned 4 [0282.556] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0282.556] lstrlenW (lpString=".rar") returned 4 [0282.556] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0282.556] lstrlenW (lpString=".bz2") returned 4 [0282.556] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0282.557] lstrlenW (lpString=".7z") returned 3 [0282.557] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0282.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0282.557] lstrlenW (lpString=".dbf") returned 4 [0282.557] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0282.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0282.557] lstrlenW (lpString=".1cd") returned 4 [0282.557] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0282.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0282.557] lstrlenW (lpString=".jpg") returned 4 [0282.557] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0282.603] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.604] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.604] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0282.604] GetLastError () returned 0x0 [0282.604] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0xae, lpOverlapped=0x0) returned 1 [0282.605] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0282.606] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.606] WriteFile (in: hFile=0x204, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0282.606] SetEndOfFile (hFile=0x204) returned 1 [0282.606] CloseHandle (hObject=0x204) returned 1 [0282.606] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.606] SetEndOfFile (hFile=0x1b0) returned 1 [0282.607] CloseHandle (hObject=0x1b0) returned 1 [0282.607] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x26) returned 1 [0282.607] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0282.608] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0282.608] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0282.608] lstrlenW (lpString=".doc") returned 4 [0282.608] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0282.608] lstrlenW (lpString=".docx") returned 5 [0282.608] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0282.608] lstrlenW (lpString=".pdf") returned 4 [0282.608] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0282.608] lstrlenW (lpString=".xls") returned 4 [0282.608] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0282.608] lstrlenW (lpString=".xlsx") returned 5 [0282.608] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0282.608] lstrlenW (lpString=".ppt") returned 4 [0282.608] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0282.608] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0282.608] lstrlenW (lpString=".zip") returned 4 [0282.608] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0282.608] lstrlenW (lpString=".rar") returned 4 [0282.608] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0282.608] lstrlenW (lpString=".bz2") returned 4 [0282.608] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0282.608] lstrlenW (lpString=".7z") returned 3 [0282.608] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0282.608] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0282.608] lstrlenW (lpString=".dbf") returned 4 [0282.608] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0282.608] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0282.609] lstrlenW (lpString=".1cd") returned 4 [0282.609] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0282.609] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0282.609] lstrlenW (lpString=".jpg") returned 4 [0282.609] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0283.747] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0283.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0283.748] lstrlenW (lpString=".doc") returned 4 [0283.748] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.748] lstrlenW (lpString=".docx") returned 5 [0283.748] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0283.748] lstrlenW (lpString=".pdf") returned 4 [0283.748] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.748] lstrlenW (lpString=".xls") returned 4 [0283.748] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.748] lstrlenW (lpString=".xlsx") returned 5 [0283.748] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0283.748] lstrlenW (lpString=".ppt") returned 4 [0283.748] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0283.748] lstrlenW (lpString=".zip") returned 4 [0283.748] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.748] lstrlenW (lpString=".rar") returned 4 [0283.748] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.748] lstrlenW (lpString=".bz2") returned 4 [0283.748] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.748] lstrlenW (lpString=".7z") returned 3 [0283.748] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0283.748] lstrlenW (lpString=".dbf") returned 4 [0283.748] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0283.749] lstrlenW (lpString=".1cd") returned 4 [0283.749] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0283.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0283.749] lstrlenW (lpString=".jpg") returned 4 [0283.749] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0283.749] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0283.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0283.750] lstrlenW (lpString=".doc") returned 4 [0283.750] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString=".docx") returned 5 [0283.750] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0283.750] lstrlenW (lpString=".pdf") returned 4 [0283.750] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString=".xls") returned 4 [0283.750] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.750] lstrlenW (lpString=".xlsx") returned 5 [0283.750] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0283.750] lstrlenW (lpString=".ppt") returned 4 [0283.750] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0283.750] lstrlenW (lpString=".zip") returned 4 [0283.750] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.750] lstrlenW (lpString=".rar") returned 4 [0283.750] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString=".bz2") returned 4 [0283.750] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString=".7z") returned 3 [0283.750] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0283.750] lstrlenW (lpString=".dbf") returned 4 [0283.750] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0283.750] lstrlenW (lpString=".1cd") returned 4 [0283.750] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0283.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0283.750] lstrlenW (lpString=".jpg") returned 4 [0283.750] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0283.751] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0283.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0283.751] lstrlenW (lpString=".doc") returned 4 [0283.751] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.751] lstrlenW (lpString=".docx") returned 5 [0283.751] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0283.751] lstrlenW (lpString=".pdf") returned 4 [0283.751] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.751] lstrlenW (lpString=".xls") returned 4 [0283.751] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.751] lstrlenW (lpString=".xlsx") returned 5 [0283.751] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0283.751] lstrlenW (lpString=".ppt") returned 4 [0283.751] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0283.751] lstrlenW (lpString=".zip") returned 4 [0283.751] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.751] lstrlenW (lpString=".rar") returned 4 [0283.751] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.751] lstrlenW (lpString=".bz2") returned 4 [0283.751] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.751] lstrlenW (lpString=".7z") returned 3 [0283.751] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0283.751] lstrlenW (lpString=".dbf") returned 4 [0283.751] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0283.752] lstrlenW (lpString=".1cd") returned 4 [0283.752] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0283.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0283.752] lstrlenW (lpString=".jpg") returned 4 [0283.752] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0283.752] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0283.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0283.752] lstrlenW (lpString=".doc") returned 4 [0283.752] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0283.752] lstrlenW (lpString=".docx") returned 5 [0283.752] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0283.752] lstrlenW (lpString=".pdf") returned 4 [0283.752] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0283.752] lstrlenW (lpString=".xls") returned 4 [0283.752] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0283.752] lstrlenW (lpString=".xlsx") returned 5 [0283.752] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0283.752] lstrlenW (lpString=".ppt") returned 4 [0283.753] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0283.753] lstrlenW (lpString=".zip") returned 4 [0283.753] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0283.753] lstrlenW (lpString=".rar") returned 4 [0283.753] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0283.753] lstrlenW (lpString=".bz2") returned 4 [0283.753] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0283.753] lstrlenW (lpString=".7z") returned 3 [0283.753] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0283.753] lstrlenW (lpString=".dbf") returned 4 [0283.753] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0283.753] lstrlenW (lpString=".1cd") returned 4 [0283.753] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0283.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0283.753] lstrlenW (lpString=".jpg") returned 4 [0283.753] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0283.768] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.768] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0283.769] GetLastError () returned 0x0 [0283.769] ReadFile (in: hFile=0x180, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x4360, lpOverlapped=0x0) returned 1 [0283.817] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0283.818] ReadFile (in: hFile=0x180, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0283.818] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0283.818] SetEndOfFile (hFile=0x218) returned 1 [0283.818] CloseHandle (hObject=0x218) returned 1 [0283.819] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.819] SetEndOfFile (hFile=0x180) returned 1 [0283.819] CloseHandle (hObject=0x180) returned 1 [0283.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0283.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0283.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0283.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0283.991] lstrlenW (lpString=".doc") returned 4 [0283.991] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString=".docx") returned 5 [0283.991] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0283.991] lstrlenW (lpString=".pdf") returned 4 [0283.991] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString=".xls") returned 4 [0283.991] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString=".xlsx") returned 5 [0283.991] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0283.991] lstrlenW (lpString=".ppt") returned 4 [0283.991] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0283.991] lstrlenW (lpString=".zip") returned 4 [0283.991] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0283.991] lstrlenW (lpString=".rar") returned 4 [0283.991] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString=".bz2") returned 4 [0283.991] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString=".7z") returned 3 [0283.991] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0283.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0283.991] lstrlenW (lpString=".dbf") returned 4 [0283.991] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0283.991] lstrlenW (lpString=".1cd") returned 4 [0283.991] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0283.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0283.991] lstrlenW (lpString=".jpg") returned 4 [0283.991] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0284.629] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.629] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0284.629] GetLastError () returned 0x0 [0284.629] ReadFile (in: hFile=0x208, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x851c, lpOverlapped=0x0) returned 1 [0284.661] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0284.663] ReadFile (in: hFile=0x208, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.663] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0284.663] SetEndOfFile (hFile=0x1f8) returned 1 [0284.663] CloseHandle (hObject=0x1f8) returned 1 [0284.663] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.663] SetEndOfFile (hFile=0x208) returned 1 [0284.664] CloseHandle (hObject=0x208) returned 1 [0284.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0284.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0284.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0284.996] lstrlenW (lpString=".doc") returned 4 [0284.996] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0284.996] lstrlenW (lpString=".docx") returned 5 [0284.996] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0284.996] lstrlenW (lpString=".pdf") returned 4 [0284.996] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0284.996] lstrlenW (lpString=".xls") returned 4 [0284.996] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0284.997] lstrlenW (lpString=".xlsx") returned 5 [0284.997] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0284.997] lstrlenW (lpString=".ppt") returned 4 [0284.997] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0284.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0284.997] lstrlenW (lpString=".zip") returned 4 [0284.997] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0284.997] lstrlenW (lpString=".rar") returned 4 [0284.997] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0284.997] lstrlenW (lpString=".bz2") returned 4 [0284.997] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0284.997] lstrlenW (lpString=".7z") returned 3 [0284.997] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0284.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0284.997] lstrlenW (lpString=".dbf") returned 4 [0284.997] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0284.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0284.997] lstrlenW (lpString=".1cd") returned 4 [0284.997] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0284.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0284.997] lstrlenW (lpString=".jpg") returned 4 [0284.997] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0285.248] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.248] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0285.248] GetLastError () returned 0x0 [0285.248] ReadFile (in: hFile=0x218, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x745e, lpOverlapped=0x0) returned 1 [0285.435] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0285.438] ReadFile (in: hFile=0x218, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.438] WriteFile (in: hFile=0x208, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0285.438] SetEndOfFile (hFile=0x208) returned 1 [0285.438] CloseHandle (hObject=0x208) returned 1 [0285.439] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.439] SetEndOfFile (hFile=0x218) returned 1 [0285.440] CloseHandle (hObject=0x218) returned 1 [0285.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0285.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0285.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0285.441] lstrlenW (lpString=".doc") returned 4 [0285.441] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0285.441] lstrlenW (lpString=".docx") returned 5 [0285.441] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0285.441] lstrlenW (lpString=".pdf") returned 4 [0285.441] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0285.441] lstrlenW (lpString=".xls") returned 4 [0285.441] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0285.441] lstrlenW (lpString=".xlsx") returned 5 [0285.441] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0285.441] lstrlenW (lpString=".ppt") returned 4 [0285.441] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0285.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0285.441] lstrlenW (lpString=".zip") returned 4 [0285.441] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0285.441] lstrlenW (lpString=".rar") returned 4 [0285.441] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0285.441] lstrlenW (lpString=".bz2") returned 4 [0285.441] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0285.441] lstrlenW (lpString=".7z") returned 3 [0285.441] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0285.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0285.441] lstrlenW (lpString=".dbf") returned 4 [0285.441] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0285.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0285.442] lstrlenW (lpString=".1cd") returned 4 [0285.442] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0285.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0285.442] lstrlenW (lpString=".jpg") returned 4 [0285.442] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0285.496] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.496] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0285.497] GetLastError () returned 0x0 [0285.497] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0285.777] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0285.875] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.875] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.875] SetEndOfFile (hFile=0x1e0) returned 1 [0285.875] CloseHandle (hObject=0x1e0) returned 1 [0285.875] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.875] SetEndOfFile (hFile=0x1f4) returned 1 [0285.876] CloseHandle (hObject=0x1f4) returned 1 [0285.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0286.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0286.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0286.545] lstrlenW (lpString=".doc") returned 4 [0286.545] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.545] lstrlenW (lpString=".docx") returned 5 [0286.545] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.545] lstrlenW (lpString=".pdf") returned 4 [0286.545] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.545] lstrlenW (lpString=".xls") returned 4 [0286.545] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.545] lstrlenW (lpString=".xlsx") returned 5 [0286.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.545] lstrlenW (lpString=".ppt") returned 4 [0286.545] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0286.545] lstrlenW (lpString=".zip") returned 4 [0286.545] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.545] lstrlenW (lpString=".rar") returned 4 [0286.546] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.546] lstrlenW (lpString=".bz2") returned 4 [0286.546] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.546] lstrlenW (lpString=".7z") returned 3 [0286.546] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0286.546] lstrlenW (lpString=".dbf") returned 4 [0286.546] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0286.546] lstrlenW (lpString=".1cd") returned 4 [0286.546] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0286.546] lstrlenW (lpString=".jpg") returned 4 [0286.546] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.546] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.546] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0286.547] GetLastError () returned 0x0 [0286.547] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0286.618] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0286.625] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.625] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.625] SetEndOfFile (hFile=0x218) returned 1 [0286.625] CloseHandle (hObject=0x218) returned 1 [0286.625] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.625] SetEndOfFile (hFile=0x1c4) returned 1 [0286.626] CloseHandle (hObject=0x1c4) returned 1 [0286.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0286.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0286.627] lstrlenW (lpString=".doc") returned 4 [0286.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.627] lstrlenW (lpString=".docx") returned 5 [0286.627] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.627] lstrlenW (lpString=".pdf") returned 4 [0286.627] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.627] lstrlenW (lpString=".xls") returned 4 [0286.627] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.627] lstrlenW (lpString=".xlsx") returned 5 [0286.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.627] lstrlenW (lpString=".ppt") returned 4 [0286.627] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0286.627] lstrlenW (lpString=".zip") returned 4 [0286.627] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.627] lstrlenW (lpString=".rar") returned 4 [0286.627] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.627] lstrlenW (lpString=".bz2") returned 4 [0286.627] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.627] lstrlenW (lpString=".7z") returned 3 [0286.627] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0286.627] lstrlenW (lpString=".dbf") returned 4 [0286.627] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0286.627] lstrlenW (lpString=".1cd") returned 4 [0286.627] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0286.628] lstrlenW (lpString=".jpg") returned 4 [0286.628] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.628] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.628] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0286.628] GetLastError () returned 0x0 [0286.628] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0286.663] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0286.664] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.664] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.664] SetEndOfFile (hFile=0x218) returned 1 [0286.664] CloseHandle (hObject=0x218) returned 1 [0286.664] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.664] SetEndOfFile (hFile=0x1c4) returned 1 [0286.665] CloseHandle (hObject=0x1c4) returned 1 [0286.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0286.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0286.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0286.671] lstrlenW (lpString=".doc") returned 4 [0286.672] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.672] lstrlenW (lpString=".docx") returned 5 [0286.672] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.672] lstrlenW (lpString=".pdf") returned 4 [0286.672] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.672] lstrlenW (lpString=".xls") returned 4 [0286.672] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.672] lstrlenW (lpString=".xlsx") returned 5 [0286.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.672] lstrlenW (lpString=".ppt") returned 4 [0286.672] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0286.672] lstrlenW (lpString=".zip") returned 4 [0286.672] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.672] lstrlenW (lpString=".rar") returned 4 [0286.672] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.672] lstrlenW (lpString=".bz2") returned 4 [0286.672] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.672] lstrlenW (lpString=".7z") returned 3 [0286.672] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0286.672] lstrlenW (lpString=".dbf") returned 4 [0286.672] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0286.672] lstrlenW (lpString=".1cd") returned 4 [0286.672] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0286.672] lstrlenW (lpString=".jpg") returned 4 [0286.672] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.672] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.673] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0286.673] GetLastError () returned 0x0 [0286.673] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0286.816] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0287.152] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.152] WriteFile (in: hFile=0x218, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.152] SetEndOfFile (hFile=0x218) returned 1 [0287.152] CloseHandle (hObject=0x218) returned 1 [0287.152] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.152] SetEndOfFile (hFile=0x1c4) returned 1 [0287.154] CloseHandle (hObject=0x1c4) returned 1 [0287.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0287.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0287.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0287.208] lstrlenW (lpString=".doc") returned 4 [0287.208] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.208] lstrlenW (lpString=".docx") returned 5 [0287.208] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.208] lstrlenW (lpString=".pdf") returned 4 [0287.208] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.208] lstrlenW (lpString=".xls") returned 4 [0287.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.208] lstrlenW (lpString=".xlsx") returned 5 [0287.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.208] lstrlenW (lpString=".ppt") returned 4 [0287.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0287.209] lstrlenW (lpString=".zip") returned 4 [0287.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.209] lstrlenW (lpString=".rar") returned 4 [0287.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.209] lstrlenW (lpString=".bz2") returned 4 [0287.209] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.209] lstrlenW (lpString=".7z") returned 3 [0287.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0287.209] lstrlenW (lpString=".dbf") returned 4 [0287.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0287.209] lstrlenW (lpString=".1cd") returned 4 [0287.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0287.209] lstrlenW (lpString=".jpg") returned 4 [0287.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 Thread: id = 14 os_tid = 0x8d0 [0260.793] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38b0480 [0260.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38c0488 [0260.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330540 [0260.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x333240 [0260.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330558 [0260.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3ba0020 [0260.794] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330570 [0260.795] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330570, Size=0x20) returned 0x35fb00 [0260.795] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330570 [0260.795] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x330570, Size=0x20) returned 0x35fad8 [0260.795] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.795] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.795] Wow64DisableWow64FsRedirection (in: OldValue=0x304ff58 | out: OldValue=0x304ff58*=0x0) returned 1 [0260.795] lstrlenW (lpString="kernel32.dll") returned 12 [0260.795] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.795] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.795] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.795] Sleep (dwMilliseconds=0x64) [0261.580] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0261.580] lstrlenW (lpString="ExcelLR.cab") returned 11 [0261.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0261.891] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=16972987) returned 1 [0261.891] CloseHandle (hObject=0x164) returned 1 [0261.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0261.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.891] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0261.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0261.892] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0261.892] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0261.892] ReadFile (in: hFile=0x164, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.922] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0261.922] ReadFile (in: hFile=0x164, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.941] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0261.941] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0261.941] ReadFile (in: hFile=0x164, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.025] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.025] WriteFile (in: hFile=0x164, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0262.051] SetEndOfFile (hFile=0x164) returned 1 [0262.051] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f43878 [0262.055] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0262.055] WriteFile (in: hFile=0x164, lpBuffer=0x3f43878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43878*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.057] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0262.057] WriteFile (in: hFile=0x164, lpBuffer=0x3f43878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43878*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.058] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0262.058] WriteFile (in: hFile=0x164, lpBuffer=0x3f43878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43878*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.059] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f43878 | out: hHeap=0x2e0000) returned 1 [0262.059] CloseHandle (hObject=0x164) returned 1 [0264.736] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0265.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.027] lstrlenW (lpString=".doc") returned 4 [0265.027] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0265.027] lstrlenW (lpString=".docx") returned 5 [0265.027] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0265.028] lstrlenW (lpString=".pdf") returned 4 [0265.028] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString=".xls") returned 4 [0265.028] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString=".xlsx") returned 5 [0265.028] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0265.028] lstrlenW (lpString=".ppt") returned 4 [0265.028] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.028] lstrlenW (lpString=".zip") returned 4 [0265.028] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString=".rar") returned 4 [0265.028] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString=".bz2") returned 4 [0265.028] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0265.028] lstrlenW (lpString=".7z") returned 3 [0265.028] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0265.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.028] lstrlenW (lpString=".dbf") returned 4 [0265.028] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.028] lstrlenW (lpString=".1cd") returned 4 [0265.028] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0265.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.028] lstrlenW (lpString=".jpg") returned 4 [0265.028] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0265.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.029] lstrlenW (lpString=".doc") returned 4 [0265.029] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString=".docx") returned 5 [0265.029] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0265.029] lstrlenW (lpString=".pdf") returned 4 [0265.029] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString=".xls") returned 4 [0265.029] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString=".xlsx") returned 5 [0265.029] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0265.029] lstrlenW (lpString=".ppt") returned 4 [0265.029] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.029] lstrlenW (lpString=".zip") returned 4 [0265.029] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString=".rar") returned 4 [0265.029] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString=".bz2") returned 4 [0265.029] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0265.029] lstrlenW (lpString=".7z") returned 3 [0265.029] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0265.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.029] lstrlenW (lpString=".dbf") returned 4 [0265.029] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0265.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.029] lstrlenW (lpString=".1cd") returned 4 [0265.029] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0265.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0265.029] lstrlenW (lpString=".jpg") returned 4 [0265.029] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0265.030] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0265.030] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0265.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0265.030] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=2865664) returned 1 [0265.030] CloseHandle (hObject=0x1c0) returned 1 [0265.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0265.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0265.030] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0265.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0265.031] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0265.031] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0265.031] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0265.135] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0265.135] ReadFile (in: hFile=0x1c0, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0265.163] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0265.163] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0265.163] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0265.215] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.215] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0265.394] SetEndOfFile (hFile=0x1c0) returned 1 [0265.394] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f5c8a8 [0265.399] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0265.399] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f5c8a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f5c8a8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0265.400] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0265.400] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f5c8a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f5c8a8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0265.407] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0265.407] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f5c8a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f5c8a8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0265.409] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f5c8a8 | out: hHeap=0x2e0000) returned 1 [0265.409] CloseHandle (hObject=0x1c0) returned 1 [0266.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0266.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.896] lstrlenW (lpString=".doc") returned 4 [0266.896] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0266.896] lstrlenW (lpString=".docx") returned 5 [0266.896] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0266.896] lstrlenW (lpString=".pdf") returned 4 [0266.896] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0266.896] lstrlenW (lpString=".xls") returned 4 [0266.896] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0266.896] lstrlenW (lpString=".xlsx") returned 5 [0266.896] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0266.896] lstrlenW (lpString=".ppt") returned 4 [0266.896] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0266.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.896] lstrlenW (lpString=".zip") returned 4 [0266.896] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0266.896] lstrlenW (lpString=".rar") returned 4 [0266.896] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0266.896] lstrlenW (lpString=".bz2") returned 4 [0266.896] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0266.897] lstrlenW (lpString=".7z") returned 3 [0266.897] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0266.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.897] lstrlenW (lpString=".dbf") returned 4 [0266.897] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0266.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.897] lstrlenW (lpString=".1cd") returned 4 [0266.897] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0266.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.897] lstrlenW (lpString=".jpg") returned 4 [0266.897] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0266.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.897] lstrlenW (lpString=".doc") returned 4 [0266.897] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0266.897] lstrlenW (lpString=".docx") returned 5 [0266.897] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0266.898] lstrlenW (lpString=".pdf") returned 4 [0266.898] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0266.898] lstrlenW (lpString=".xls") returned 4 [0266.898] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0266.898] lstrlenW (lpString=".xlsx") returned 5 [0266.898] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0266.898] lstrlenW (lpString=".ppt") returned 4 [0266.898] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0266.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.898] lstrlenW (lpString=".zip") returned 4 [0266.898] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0266.898] lstrlenW (lpString=".rar") returned 4 [0266.898] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0266.898] lstrlenW (lpString=".bz2") returned 4 [0266.898] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0266.898] lstrlenW (lpString=".7z") returned 3 [0266.898] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0266.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.898] lstrlenW (lpString=".dbf") returned 4 [0266.898] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0266.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.899] lstrlenW (lpString=".1cd") returned 4 [0266.899] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0266.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0266.899] lstrlenW (lpString=".jpg") returned 4 [0266.899] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0266.899] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0266.899] lstrlenW (lpString="Proof.cab") returned 9 [0266.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0266.899] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=11482605) returned 1 [0266.899] CloseHandle (hObject=0x1c0) returned 1 [0266.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0266.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0266.900] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0267.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0267.467] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0267.467] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0267.467] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0267.491] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0267.491] ReadFile (in: hFile=0x1c0, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0267.503] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0267.503] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0267.503] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0267.588] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.588] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0267.872] SetEndOfFile (hFile=0x1c0) returned 1 [0267.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0267.876] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.876] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.877] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.877] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.879] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.879] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.881] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0267.882] CloseHandle (hObject=0x1c0) returned 1 [0270.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0270.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.511] lstrlenW (lpString=".doc") returned 4 [0270.511] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString=".docx") returned 5 [0270.511] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0270.511] lstrlenW (lpString=".pdf") returned 4 [0270.511] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString=".xls") returned 4 [0270.511] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString=".xlsx") returned 5 [0270.511] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0270.511] lstrlenW (lpString=".ppt") returned 4 [0270.511] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.511] lstrlenW (lpString=".zip") returned 4 [0270.511] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString=".rar") returned 4 [0270.511] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString=".bz2") returned 4 [0270.511] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0270.511] lstrlenW (lpString=".7z") returned 3 [0270.511] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0270.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.511] lstrlenW (lpString=".dbf") returned 4 [0270.511] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0270.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.511] lstrlenW (lpString=".1cd") returned 4 [0270.512] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0270.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.512] lstrlenW (lpString=".jpg") returned 4 [0270.512] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.512] lstrlenW (lpString=".doc") returned 4 [0270.512] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString=".docx") returned 5 [0270.512] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0270.512] lstrlenW (lpString=".pdf") returned 4 [0270.512] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString=".xls") returned 4 [0270.512] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString=".xlsx") returned 5 [0270.512] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0270.512] lstrlenW (lpString=".ppt") returned 4 [0270.512] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.512] lstrlenW (lpString=".zip") returned 4 [0270.512] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString=".rar") returned 4 [0270.512] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0270.512] lstrlenW (lpString=".bz2") returned 4 [0270.512] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0270.512] lstrlenW (lpString=".7z") returned 3 [0270.512] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0270.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.513] lstrlenW (lpString=".dbf") returned 4 [0270.513] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0270.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.513] lstrlenW (lpString=".1cd") returned 4 [0270.513] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0270.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0270.513] lstrlenW (lpString=".jpg") returned 4 [0270.513] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0270.513] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0270.513] lstrlenW (lpString="Office32MUI.msi") returned 15 [0270.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0270.514] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=873984) returned 1 [0270.514] CloseHandle (hObject=0x1c0) returned 1 [0270.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0270.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0270.514] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.514] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0270.514] GetLastError () returned 0x0 [0270.514] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0270.802] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0270.818] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.818] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0270.818] SetEndOfFile (hFile=0x18c) returned 1 [0270.818] CloseHandle (hObject=0x18c) returned 1 [0271.215] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.215] SetEndOfFile (hFile=0x1c0) returned 1 [0271.223] CloseHandle (hObject=0x1c0) returned 1 [0271.223] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0271.223] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0271.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.223] lstrlenW (lpString=".doc") returned 4 [0271.223] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0271.223] lstrlenW (lpString=".docx") returned 5 [0271.223] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0271.223] lstrlenW (lpString=".pdf") returned 4 [0271.224] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString=".xls") returned 4 [0271.224] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString=".xlsx") returned 5 [0271.224] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0271.224] lstrlenW (lpString=".ppt") returned 4 [0271.224] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.224] lstrlenW (lpString=".zip") returned 4 [0271.224] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString=".rar") returned 4 [0271.224] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString=".bz2") returned 4 [0271.224] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0271.224] lstrlenW (lpString=".7z") returned 3 [0271.224] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0271.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.224] lstrlenW (lpString=".dbf") returned 4 [0271.224] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0271.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.224] lstrlenW (lpString=".1cd") returned 4 [0271.224] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0271.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.224] lstrlenW (lpString=".jpg") returned 4 [0271.224] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0271.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.224] lstrlenW (lpString=".doc") returned 4 [0271.224] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0271.224] lstrlenW (lpString=".docx") returned 5 [0271.224] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0271.224] lstrlenW (lpString=".pdf") returned 4 [0271.224] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString=".xls") returned 4 [0271.224] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0271.224] lstrlenW (lpString=".xlsx") returned 5 [0271.224] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0271.225] lstrlenW (lpString=".ppt") returned 4 [0271.225] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0271.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.225] lstrlenW (lpString=".zip") returned 4 [0271.225] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0271.225] lstrlenW (lpString=".rar") returned 4 [0271.225] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0271.225] lstrlenW (lpString=".bz2") returned 4 [0271.225] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0271.225] lstrlenW (lpString=".7z") returned 3 [0271.225] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0271.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.225] lstrlenW (lpString=".dbf") returned 4 [0271.225] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0271.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.225] lstrlenW (lpString=".1cd") returned 4 [0271.225] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0271.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0271.225] lstrlenW (lpString=".jpg") returned 4 [0271.225] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0271.225] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0271.225] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0271.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0271.226] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=3124224) returned 1 [0271.226] CloseHandle (hObject=0x1c0) returned 1 [0271.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0271.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.226] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0271.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0271.226] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0271.227] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.227] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.253] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.253] ReadFile (in: hFile=0x1c0, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.290] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0271.290] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.290] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0271.316] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.316] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0271.684] SetEndOfFile (hFile=0x1c0) returned 1 [0271.684] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0271.703] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0271.704] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.705] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0271.705] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.711] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0271.711] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0271.714] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0271.716] CloseHandle (hObject=0x1c0) returned 1 [0271.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0271.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.717] lstrlenW (lpString=".doc") returned 4 [0271.717] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0271.717] lstrlenW (lpString=".docx") returned 5 [0271.717] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0271.717] lstrlenW (lpString=".pdf") returned 4 [0271.717] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0271.717] lstrlenW (lpString=".xls") returned 4 [0271.717] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0271.717] lstrlenW (lpString=".xlsx") returned 5 [0271.717] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0271.718] lstrlenW (lpString=".ppt") returned 4 [0271.718] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0271.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.718] lstrlenW (lpString=".zip") returned 4 [0271.718] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0271.718] lstrlenW (lpString=".rar") returned 4 [0271.718] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0271.718] lstrlenW (lpString=".bz2") returned 4 [0271.718] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0271.718] lstrlenW (lpString=".7z") returned 3 [0271.718] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0271.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.718] lstrlenW (lpString=".dbf") returned 4 [0271.718] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0271.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.718] lstrlenW (lpString=".1cd") returned 4 [0271.718] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0271.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.718] lstrlenW (lpString=".jpg") returned 4 [0271.718] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0271.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.718] lstrlenW (lpString=".doc") returned 4 [0271.718] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0271.718] lstrlenW (lpString=".docx") returned 5 [0271.718] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0271.718] lstrlenW (lpString=".pdf") returned 4 [0271.719] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0271.719] lstrlenW (lpString=".xls") returned 4 [0271.719] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0271.719] lstrlenW (lpString=".xlsx") returned 5 [0271.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0271.719] lstrlenW (lpString=".ppt") returned 4 [0271.719] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0271.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.719] lstrlenW (lpString=".zip") returned 4 [0271.719] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0271.719] lstrlenW (lpString=".rar") returned 4 [0271.719] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0271.719] lstrlenW (lpString=".bz2") returned 4 [0271.719] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0271.719] lstrlenW (lpString=".7z") returned 3 [0271.719] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0271.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.719] lstrlenW (lpString=".dbf") returned 4 [0271.719] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0271.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.719] lstrlenW (lpString=".1cd") returned 4 [0271.719] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0271.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0271.719] lstrlenW (lpString=".jpg") returned 4 [0271.719] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0271.720] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0271.720] lstrlenW (lpString="VisioLR.cab") returned 11 [0271.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0271.720] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=50823389) returned 1 [0271.720] CloseHandle (hObject=0x1c0) returned 1 [0271.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0271.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.720] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0271.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0271.721] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0271.721] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0271.721] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0272.934] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0272.934] ReadFile (in: hFile=0x1c0, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0277.706] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0277.706] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0277.706] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0277.842] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.842] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0278.090] SetEndOfFile (hFile=0x1c0) returned 1 [0278.090] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0278.091] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.091] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.091] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.091] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.092] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.092] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.095] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0278.095] CloseHandle (hObject=0x1c0) returned 1 [0278.095] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.095] lstrlenW (lpString=".doc") returned 4 [0278.095] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.095] lstrlenW (lpString=".docx") returned 5 [0278.095] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.095] lstrlenW (lpString=".pdf") returned 4 [0278.096] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.096] lstrlenW (lpString=".xls") returned 4 [0278.096] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.096] lstrlenW (lpString=".xlsx") returned 5 [0278.096] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.096] lstrlenW (lpString=".ppt") returned 4 [0278.096] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.096] lstrlenW (lpString=".zip") returned 4 [0278.096] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.096] lstrlenW (lpString=".rar") returned 4 [0278.096] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.096] lstrlenW (lpString=".bz2") returned 4 [0278.096] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.096] lstrlenW (lpString=".7z") returned 3 [0278.096] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.096] lstrlenW (lpString=".dbf") returned 4 [0278.096] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.096] lstrlenW (lpString=".1cd") returned 4 [0278.096] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.096] lstrlenW (lpString=".jpg") returned 4 [0278.096] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.097] lstrlenW (lpString=".doc") returned 4 [0278.097] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString=".docx") returned 5 [0278.097] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.097] lstrlenW (lpString=".pdf") returned 4 [0278.097] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString=".xls") returned 4 [0278.097] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString=".xlsx") returned 5 [0278.097] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.097] lstrlenW (lpString=".ppt") returned 4 [0278.097] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.097] lstrlenW (lpString=".zip") returned 4 [0278.097] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString=".rar") returned 4 [0278.097] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString=".bz2") returned 4 [0278.097] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.097] lstrlenW (lpString=".7z") returned 3 [0278.097] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.097] lstrlenW (lpString=".dbf") returned 4 [0278.097] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.097] lstrlenW (lpString=".1cd") returned 4 [0278.097] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0278.097] lstrlenW (lpString=".jpg") returned 4 [0278.097] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.098] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0278.098] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0278.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.098] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=868864) returned 1 [0278.098] CloseHandle (hObject=0x1c0) returned 1 [0278.098] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0278.098] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.098] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.098] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.098] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.099] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0278.099] GetLastError () returned 0x0 [0278.099] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0278.143] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0278.166] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.166] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0278.167] SetEndOfFile (hFile=0x204) returned 1 [0278.167] CloseHandle (hObject=0x204) returned 1 [0278.209] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.209] SetEndOfFile (hFile=0x1c0) returned 1 [0278.219] CloseHandle (hObject=0x1c0) returned 1 [0278.219] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.220] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0278.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.221] lstrlenW (lpString=".doc") returned 4 [0278.221] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0278.221] lstrlenW (lpString=".docx") returned 5 [0278.221] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0278.221] lstrlenW (lpString=".pdf") returned 4 [0278.221] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0278.221] lstrlenW (lpString=".xls") returned 4 [0278.221] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0278.222] lstrlenW (lpString=".xlsx") returned 5 [0278.222] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0278.222] lstrlenW (lpString=".ppt") returned 4 [0278.222] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0278.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.222] lstrlenW (lpString=".zip") returned 4 [0278.222] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0278.222] lstrlenW (lpString=".rar") returned 4 [0278.222] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0278.222] lstrlenW (lpString=".bz2") returned 4 [0278.222] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0278.222] lstrlenW (lpString=".7z") returned 3 [0278.222] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0278.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.222] lstrlenW (lpString=".dbf") returned 4 [0278.222] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0278.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.222] lstrlenW (lpString=".1cd") returned 4 [0278.223] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0278.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.223] lstrlenW (lpString=".jpg") returned 4 [0278.223] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0278.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.223] lstrlenW (lpString=".doc") returned 4 [0278.223] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0278.223] lstrlenW (lpString=".docx") returned 5 [0278.223] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0278.223] lstrlenW (lpString=".pdf") returned 4 [0278.223] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0278.223] lstrlenW (lpString=".xls") returned 4 [0278.223] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0278.223] lstrlenW (lpString=".xlsx") returned 5 [0278.223] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0278.223] lstrlenW (lpString=".ppt") returned 4 [0278.223] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0278.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.224] lstrlenW (lpString=".zip") returned 4 [0278.224] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0278.224] lstrlenW (lpString=".rar") returned 4 [0278.224] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0278.224] lstrlenW (lpString=".bz2") returned 4 [0278.224] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0278.224] lstrlenW (lpString=".7z") returned 3 [0278.224] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0278.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.224] lstrlenW (lpString=".dbf") returned 4 [0278.224] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0278.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.224] lstrlenW (lpString=".1cd") returned 4 [0278.224] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0278.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0278.224] lstrlenW (lpString=".jpg") returned 4 [0278.224] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0278.308] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0278.308] lstrlenW (lpString="osetupui.dll") returned 12 [0278.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.308] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=191872) returned 1 [0278.309] CloseHandle (hObject=0x1c0) returned 1 [0278.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0278.309] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.309] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.309] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0278.310] GetLastError () returned 0x0 [0278.310] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0278.428] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0278.434] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.434] WriteFile (in: hFile=0x204, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.434] SetEndOfFile (hFile=0x204) returned 1 [0278.434] CloseHandle (hObject=0x204) returned 1 [0278.434] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.434] SetEndOfFile (hFile=0x1c0) returned 1 [0278.437] CloseHandle (hObject=0x1c0) returned 1 [0278.437] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.437] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0278.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.437] lstrlenW (lpString=".doc") returned 4 [0278.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.437] lstrlenW (lpString=".docx") returned 5 [0278.437] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0278.438] lstrlenW (lpString=".pdf") returned 4 [0278.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.438] lstrlenW (lpString=".xls") returned 4 [0278.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.438] lstrlenW (lpString=".xlsx") returned 5 [0278.438] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0278.438] lstrlenW (lpString=".ppt") returned 4 [0278.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.438] lstrlenW (lpString=".zip") returned 4 [0278.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.438] lstrlenW (lpString=".rar") returned 4 [0278.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.438] lstrlenW (lpString=".bz2") returned 4 [0278.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.438] lstrlenW (lpString=".7z") returned 3 [0278.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.438] lstrlenW (lpString=".dbf") returned 4 [0278.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.438] lstrlenW (lpString=".1cd") returned 4 [0278.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.438] lstrlenW (lpString=".jpg") returned 4 [0278.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.439] lstrlenW (lpString=".doc") returned 4 [0278.439] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString=".docx") returned 5 [0278.439] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0278.439] lstrlenW (lpString=".pdf") returned 4 [0278.439] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString=".xls") returned 4 [0278.439] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString=".xlsx") returned 5 [0278.439] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0278.439] lstrlenW (lpString=".ppt") returned 4 [0278.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.439] lstrlenW (lpString=".zip") returned 4 [0278.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString=".rar") returned 4 [0278.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.439] lstrlenW (lpString=".bz2") returned 4 [0278.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.439] lstrlenW (lpString=".7z") returned 3 [0278.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.439] lstrlenW (lpString=".dbf") returned 4 [0278.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.439] lstrlenW (lpString=".1cd") returned 4 [0278.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0278.440] lstrlenW (lpString=".jpg") returned 4 [0278.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.440] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0278.440] lstrlenW (lpString="AccLR.cab") returned 9 [0278.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0278.470] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=28016276) returned 1 [0278.470] CloseHandle (hObject=0x208) returned 1 [0278.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0278.470] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.470] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0278.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0278.474] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0278.474] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.474] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.511] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.511] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.525] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0278.525] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.525] ReadFile (in: hFile=0x208, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.567] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.567] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0278.593] SetEndOfFile (hFile=0x208) returned 1 [0278.593] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0278.593] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.593] WriteFile (in: hFile=0x208, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.594] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.594] WriteFile (in: hFile=0x208, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.597] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0278.597] WriteFile (in: hFile=0x208, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.600] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0278.600] CloseHandle (hObject=0x208) returned 1 [0278.600] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.600] lstrlenW (lpString=".doc") returned 4 [0278.601] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString=".docx") returned 5 [0278.601] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.601] lstrlenW (lpString=".pdf") returned 4 [0278.601] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString=".xls") returned 4 [0278.601] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString=".xlsx") returned 5 [0278.601] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.601] lstrlenW (lpString=".ppt") returned 4 [0278.601] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.601] lstrlenW (lpString=".zip") returned 4 [0278.601] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString=".rar") returned 4 [0278.601] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString=".bz2") returned 4 [0278.601] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.601] lstrlenW (lpString=".7z") returned 3 [0278.601] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.601] lstrlenW (lpString=".dbf") returned 4 [0278.601] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.601] lstrlenW (lpString=".1cd") returned 4 [0278.601] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.602] lstrlenW (lpString=".jpg") returned 4 [0278.602] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.602] lstrlenW (lpString=".doc") returned 4 [0278.602] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString=".docx") returned 5 [0278.602] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.602] lstrlenW (lpString=".pdf") returned 4 [0278.602] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString=".xls") returned 4 [0278.602] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString=".xlsx") returned 5 [0278.602] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.602] lstrlenW (lpString=".ppt") returned 4 [0278.602] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.602] lstrlenW (lpString=".zip") returned 4 [0278.602] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString=".rar") returned 4 [0278.602] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.602] lstrlenW (lpString=".bz2") returned 4 [0278.602] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.602] lstrlenW (lpString=".7z") returned 3 [0278.602] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.602] lstrlenW (lpString=".dbf") returned 4 [0278.603] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.603] lstrlenW (lpString=".1cd") returned 4 [0278.603] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0278.603] lstrlenW (lpString=".jpg") returned 4 [0278.603] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.603] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0278.603] lstrlenW (lpString="Office32WW.msi") returned 14 [0278.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0278.603] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=1992192) returned 1 [0278.604] CloseHandle (hObject=0x208) returned 1 [0278.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0278.604] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.604] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0278.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0278.605] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0278.605] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.605] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.677] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.677] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.911] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0278.911] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0278.911] ReadFile (in: hFile=0x208, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.973] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.973] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0279.333] SetEndOfFile (hFile=0x208) returned 1 [0279.333] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0279.347] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0279.347] WriteFile (in: hFile=0x208, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.349] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0279.349] WriteFile (in: hFile=0x208, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.359] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0279.359] WriteFile (in: hFile=0x208, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.369] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0279.369] CloseHandle (hObject=0x208) returned 1 [0279.369] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.370] lstrlenW (lpString=".doc") returned 4 [0279.370] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.370] lstrlenW (lpString=".docx") returned 5 [0279.370] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0279.370] lstrlenW (lpString=".pdf") returned 4 [0279.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.370] lstrlenW (lpString=".xls") returned 4 [0279.370] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.370] lstrlenW (lpString=".xlsx") returned 5 [0279.370] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0279.370] lstrlenW (lpString=".ppt") returned 4 [0279.370] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.370] lstrlenW (lpString=".zip") returned 4 [0279.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.370] lstrlenW (lpString=".rar") returned 4 [0279.370] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.370] lstrlenW (lpString=".bz2") returned 4 [0279.370] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.370] lstrlenW (lpString=".7z") returned 3 [0279.371] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.371] lstrlenW (lpString=".dbf") returned 4 [0279.371] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.371] lstrlenW (lpString=".1cd") returned 4 [0279.371] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.371] lstrlenW (lpString=".jpg") returned 4 [0279.371] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.371] lstrlenW (lpString=".doc") returned 4 [0279.371] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.371] lstrlenW (lpString=".docx") returned 5 [0279.371] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0279.371] lstrlenW (lpString=".pdf") returned 4 [0279.371] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.371] lstrlenW (lpString=".xls") returned 4 [0279.371] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.371] lstrlenW (lpString=".xlsx") returned 5 [0279.371] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0279.371] lstrlenW (lpString=".ppt") returned 4 [0279.371] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.371] lstrlenW (lpString=".zip") returned 4 [0279.372] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.372] lstrlenW (lpString=".rar") returned 4 [0279.372] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.372] lstrlenW (lpString=".bz2") returned 4 [0279.372] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.372] lstrlenW (lpString=".7z") returned 3 [0279.372] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.372] lstrlenW (lpString=".dbf") returned 4 [0279.372] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.372] lstrlenW (lpString=".1cd") returned 4 [0279.372] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0279.372] lstrlenW (lpString=".jpg") returned 4 [0279.372] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.372] lstrcmpiW (lpString1=".xrm-ms", lpString2=".drweb") returned 1 [0279.372] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0279.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0279.373] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=715834) returned 1 [0279.373] CloseHandle (hObject=0x208) returned 1 [0279.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0279.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0279.373] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.373] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0279.374] GetLastError () returned 0x0 [0279.374] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0279.504] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0279.520] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.520] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x104, lpOverlapped=0x0) returned 1 [0279.520] SetEndOfFile (hFile=0x218) returned 1 [0279.520] CloseHandle (hObject=0x218) returned 1 [0279.521] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.521] SetEndOfFile (hFile=0x208) returned 1 [0279.683] CloseHandle (hObject=0x208) returned 1 [0279.683] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.683] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0279.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.684] lstrlenW (lpString=".doc") returned 4 [0279.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString=".docx") returned 5 [0279.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0279.684] lstrlenW (lpString=".pdf") returned 4 [0279.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString=".xls") returned 4 [0279.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString=".xlsx") returned 5 [0279.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0279.684] lstrlenW (lpString=".ppt") returned 4 [0279.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.684] lstrlenW (lpString=".zip") returned 4 [0279.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString=".rar") returned 4 [0279.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString=".bz2") returned 4 [0279.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString=".7z") returned 3 [0279.684] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0279.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.684] lstrlenW (lpString=".dbf") returned 4 [0279.684] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.684] lstrlenW (lpString=".1cd") returned 4 [0279.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0279.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.685] lstrlenW (lpString=".jpg") returned 4 [0279.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.685] lstrlenW (lpString=".doc") returned 4 [0279.685] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString=".docx") returned 5 [0279.685] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0279.685] lstrlenW (lpString=".pdf") returned 4 [0279.685] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString=".xls") returned 4 [0279.685] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString=".xlsx") returned 5 [0279.685] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0279.685] lstrlenW (lpString=".ppt") returned 4 [0279.685] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.685] lstrlenW (lpString=".zip") returned 4 [0279.685] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString=".rar") returned 4 [0279.685] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0279.685] lstrlenW (lpString=".bz2") returned 4 [0279.686] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0279.686] lstrlenW (lpString=".7z") returned 3 [0279.686] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0279.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.686] lstrlenW (lpString=".dbf") returned 4 [0279.686] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0279.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.686] lstrlenW (lpString=".1cd") returned 4 [0279.686] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0279.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0279.686] lstrlenW (lpString=".jpg") returned 4 [0279.686] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0279.686] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0279.686] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0279.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0279.686] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=222948913) returned 1 [0279.686] CloseHandle (hObject=0x208) returned 1 [0279.686] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0279.687] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.687] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0279.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0279.696] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0279.696] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0279.696] ReadFile (in: hFile=0x208, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0280.175] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0280.176] ReadFile (in: hFile=0x208, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0280.294] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0280.294] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0280.294] ReadFile (in: hFile=0x208, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0280.361] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.361] WriteFile (in: hFile=0x208, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0280.436] SetEndOfFile (hFile=0x208) returned 1 [0280.436] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0280.436] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0280.436] WriteFile (in: hFile=0x208, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0280.437] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0280.437] WriteFile (in: hFile=0x208, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0280.440] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0280.440] WriteFile (in: hFile=0x208, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0280.442] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0280.442] CloseHandle (hObject=0x208) returned 1 [0280.442] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0280.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.442] lstrlenW (lpString=".doc") returned 4 [0280.442] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0280.442] lstrlenW (lpString=".docx") returned 5 [0280.442] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0280.442] lstrlenW (lpString=".pdf") returned 4 [0280.442] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0280.442] lstrlenW (lpString=".xls") returned 4 [0280.442] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0280.442] lstrlenW (lpString=".xlsx") returned 5 [0280.442] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0280.443] lstrlenW (lpString=".ppt") returned 4 [0280.443] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0280.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.443] lstrlenW (lpString=".zip") returned 4 [0280.443] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0280.443] lstrlenW (lpString=".rar") returned 4 [0280.443] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0280.443] lstrlenW (lpString=".bz2") returned 4 [0280.443] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0280.443] lstrlenW (lpString=".7z") returned 3 [0280.443] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0280.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.443] lstrlenW (lpString=".dbf") returned 4 [0280.443] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0280.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.443] lstrlenW (lpString=".1cd") returned 4 [0280.443] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0280.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.443] lstrlenW (lpString=".jpg") returned 4 [0280.443] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0280.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.443] lstrlenW (lpString=".doc") returned 4 [0280.443] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0280.443] lstrlenW (lpString=".docx") returned 5 [0280.443] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0280.443] lstrlenW (lpString=".pdf") returned 4 [0280.444] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0280.444] lstrlenW (lpString=".xls") returned 4 [0280.444] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0280.444] lstrlenW (lpString=".xlsx") returned 5 [0280.444] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0280.444] lstrlenW (lpString=".ppt") returned 4 [0280.444] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0280.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.444] lstrlenW (lpString=".zip") returned 4 [0280.444] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0280.444] lstrlenW (lpString=".rar") returned 4 [0280.444] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0280.444] lstrlenW (lpString=".bz2") returned 4 [0280.444] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0280.444] lstrlenW (lpString=".7z") returned 3 [0280.444] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0280.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.444] lstrlenW (lpString=".dbf") returned 4 [0280.444] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0280.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.444] lstrlenW (lpString=".1cd") returned 4 [0280.444] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0280.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0280.444] lstrlenW (lpString=".jpg") returned 4 [0280.444] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0280.445] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0280.445] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0280.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0281.463] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=36233052) returned 1 [0281.463] CloseHandle (hObject=0x164) returned 1 [0281.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0281.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.463] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0281.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0281.464] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0281.464] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0281.464] ReadFile (in: hFile=0x164, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.523] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0281.523] ReadFile (in: hFile=0x164, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.791] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0281.791] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0281.791] ReadFile (in: hFile=0x164, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.915] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.915] WriteFile (in: hFile=0x164, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0281.941] SetEndOfFile (hFile=0x164) returned 1 [0281.941] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0282.226] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0282.227] WriteFile (in: hFile=0x164, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.227] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0282.227] WriteFile (in: hFile=0x164, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.228] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0282.228] WriteFile (in: hFile=0x164, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.230] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0282.231] CloseHandle (hObject=0x164) returned 1 [0282.461] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0282.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.461] lstrlenW (lpString=".doc") returned 4 [0282.461] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0282.461] lstrlenW (lpString=".docx") returned 5 [0282.461] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0282.461] lstrlenW (lpString=".pdf") returned 4 [0282.461] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0282.461] lstrlenW (lpString=".xls") returned 4 [0282.461] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0282.462] lstrlenW (lpString=".xlsx") returned 5 [0282.462] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0282.462] lstrlenW (lpString=".ppt") returned 4 [0282.462] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0282.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.462] lstrlenW (lpString=".zip") returned 4 [0282.462] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0282.462] lstrlenW (lpString=".rar") returned 4 [0282.462] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0282.462] lstrlenW (lpString=".bz2") returned 4 [0282.462] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0282.462] lstrlenW (lpString=".7z") returned 3 [0282.462] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0282.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.462] lstrlenW (lpString=".dbf") returned 4 [0282.462] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0282.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.462] lstrlenW (lpString=".1cd") returned 4 [0282.462] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0282.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.462] lstrlenW (lpString=".jpg") returned 4 [0282.462] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0282.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.462] lstrlenW (lpString=".doc") returned 4 [0282.462] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString=".docx") returned 5 [0282.463] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0282.463] lstrlenW (lpString=".pdf") returned 4 [0282.463] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString=".xls") returned 4 [0282.463] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString=".xlsx") returned 5 [0282.463] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0282.463] lstrlenW (lpString=".ppt") returned 4 [0282.463] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.463] lstrlenW (lpString=".zip") returned 4 [0282.463] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString=".rar") returned 4 [0282.463] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString=".bz2") returned 4 [0282.463] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0282.463] lstrlenW (lpString=".7z") returned 3 [0282.463] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0282.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.463] lstrlenW (lpString=".dbf") returned 4 [0282.463] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0282.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.463] lstrlenW (lpString=".1cd") returned 4 [0282.463] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0282.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0282.463] lstrlenW (lpString=".jpg") returned 4 [0282.463] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0282.464] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0282.464] lstrlenW (lpString="setup.exe") returned 9 [0282.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0282.592] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=1377656) returned 1 [0282.592] CloseHandle (hObject=0x1c0) returned 1 [0282.592] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0282.592] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0282.592] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.592] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0282.593] GetLastError () returned 0x0 [0282.593] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0282.673] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0282.742] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x50588, lpOverlapped=0x0) returned 1 [0282.778] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0282.826] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.826] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.826] SetEndOfFile (hFile=0x1c4) returned 1 [0282.826] CloseHandle (hObject=0x1c4) returned 1 [0282.826] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.826] SetEndOfFile (hFile=0x1c0) returned 1 [0282.830] CloseHandle (hObject=0x1c0) returned 1 [0282.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0282.830] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0282.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.831] lstrlenW (lpString=".doc") returned 4 [0282.831] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0282.831] lstrlenW (lpString=".docx") returned 5 [0282.831] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0282.831] lstrlenW (lpString=".pdf") returned 4 [0282.831] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0282.831] lstrlenW (lpString=".xls") returned 4 [0282.831] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0282.831] lstrlenW (lpString=".xlsx") returned 5 [0282.831] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0282.831] lstrlenW (lpString=".ppt") returned 4 [0282.831] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0282.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.831] lstrlenW (lpString=".zip") returned 4 [0282.831] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0282.831] lstrlenW (lpString=".rar") returned 4 [0282.831] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0282.831] lstrlenW (lpString=".bz2") returned 4 [0282.831] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0282.869] lstrlenW (lpString=".7z") returned 3 [0282.869] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0282.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.869] lstrlenW (lpString=".dbf") returned 4 [0282.869] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0282.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.869] lstrlenW (lpString=".1cd") returned 4 [0282.869] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0282.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.869] lstrlenW (lpString=".jpg") returned 4 [0282.869] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0282.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.870] lstrlenW (lpString=".doc") returned 4 [0282.870] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0282.870] lstrlenW (lpString=".docx") returned 5 [0282.870] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0282.870] lstrlenW (lpString=".pdf") returned 4 [0282.870] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0282.870] lstrlenW (lpString=".xls") returned 4 [0282.870] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0282.870] lstrlenW (lpString=".xlsx") returned 5 [0282.870] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0282.870] lstrlenW (lpString=".ppt") returned 4 [0282.870] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0282.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.870] lstrlenW (lpString=".zip") returned 4 [0282.870] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0282.870] lstrlenW (lpString=".rar") returned 4 [0282.870] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0282.870] lstrlenW (lpString=".bz2") returned 4 [0282.870] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0282.870] lstrlenW (lpString=".7z") returned 3 [0282.870] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0282.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.870] lstrlenW (lpString=".dbf") returned 4 [0282.870] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0282.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.870] lstrlenW (lpString=".1cd") returned 4 [0282.870] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0282.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0282.870] lstrlenW (lpString=".jpg") returned 4 [0282.870] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0282.870] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0282.870] lstrlenW (lpString="osetup.dll") returned 10 [0282.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0282.986] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=7378792) returned 1 [0282.986] CloseHandle (hObject=0x1c4) returned 1 [0282.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0282.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.987] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0282.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0282.988] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0282.988] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0282.988] ReadFile (in: hFile=0x1c4, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.126] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0283.126] ReadFile (in: hFile=0x1c4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.239] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0283.239] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0283.239] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.339] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0283.339] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0283.517] SetEndOfFile (hFile=0x1c4) returned 1 [0283.517] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0283.524] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0283.524] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.529] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0283.529] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.531] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0283.531] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.532] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0283.535] CloseHandle (hObject=0x1c4) returned 1 [0283.535] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.535] lstrlenW (lpString=".doc") returned 4 [0283.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.535] lstrlenW (lpString=".docx") returned 5 [0283.535] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0283.535] lstrlenW (lpString=".pdf") returned 4 [0283.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.535] lstrlenW (lpString=".xls") returned 4 [0283.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.535] lstrlenW (lpString=".xlsx") returned 5 [0283.535] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0283.535] lstrlenW (lpString=".ppt") returned 4 [0283.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.535] lstrlenW (lpString=".zip") returned 4 [0283.536] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.536] lstrlenW (lpString=".rar") returned 4 [0283.536] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.536] lstrlenW (lpString=".bz2") returned 4 [0283.536] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.536] lstrlenW (lpString=".7z") returned 3 [0283.536] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.536] lstrlenW (lpString=".dbf") returned 4 [0283.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.536] lstrlenW (lpString=".1cd") returned 4 [0283.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.536] lstrlenW (lpString=".jpg") returned 4 [0283.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.536] lstrlenW (lpString=".doc") returned 4 [0283.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0283.536] lstrlenW (lpString=".docx") returned 5 [0283.536] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0283.536] lstrlenW (lpString=".pdf") returned 4 [0283.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0283.536] lstrlenW (lpString=".xls") returned 4 [0283.536] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0283.536] lstrlenW (lpString=".xlsx") returned 5 [0283.536] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0283.536] lstrlenW (lpString=".ppt") returned 4 [0283.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0283.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.537] lstrlenW (lpString=".zip") returned 4 [0283.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0283.537] lstrlenW (lpString=".rar") returned 4 [0283.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0283.537] lstrlenW (lpString=".bz2") returned 4 [0283.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0283.537] lstrlenW (lpString=".7z") returned 3 [0283.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0283.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.537] lstrlenW (lpString=".dbf") returned 4 [0283.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0283.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.537] lstrlenW (lpString=".1cd") returned 4 [0283.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0283.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0283.537] lstrlenW (lpString=".jpg") returned 4 [0283.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0283.537] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0283.537] lstrlenW (lpString="VisiorWW.cab") returned 12 [0283.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0283.568] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=195011319) returned 1 [0283.568] CloseHandle (hObject=0x210) returned 1 [0283.568] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0283.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.569] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0283.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0283.569] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0283.569] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0283.569] ReadFile (in: hFile=0x210, lpBuffer=0x3ba0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ba0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.978] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0283.978] ReadFile (in: hFile=0x210, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0284.099] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0284.099] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0284.099] ReadFile (in: hFile=0x210, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0284.206] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.206] WriteFile (in: hFile=0x210, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0284.222] SetEndOfFile (hFile=0x210) returned 1 [0284.222] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f63888 [0284.225] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0284.225] WriteFile (in: hFile=0x210, lpBuffer=0x3f63888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63888*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.225] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0284.225] WriteFile (in: hFile=0x210, lpBuffer=0x3f63888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63888*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.227] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0284.228] WriteFile (in: hFile=0x210, lpBuffer=0x3f63888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63888*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.230] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f63888 | out: hHeap=0x2e0000) returned 1 [0284.230] CloseHandle (hObject=0x210) returned 1 [0284.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0284.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.230] lstrlenW (lpString=".doc") returned 4 [0284.230] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0284.230] lstrlenW (lpString=".docx") returned 5 [0284.230] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0284.230] lstrlenW (lpString=".pdf") returned 4 [0284.230] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0284.230] lstrlenW (lpString=".xls") returned 4 [0284.230] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString=".xlsx") returned 5 [0284.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0284.231] lstrlenW (lpString=".ppt") returned 4 [0284.231] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.231] lstrlenW (lpString=".zip") returned 4 [0284.231] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString=".rar") returned 4 [0284.231] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString=".bz2") returned 4 [0284.231] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0284.231] lstrlenW (lpString=".7z") returned 3 [0284.231] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0284.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.231] lstrlenW (lpString=".dbf") returned 4 [0284.231] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.231] lstrlenW (lpString=".1cd") returned 4 [0284.231] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0284.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.231] lstrlenW (lpString=".jpg") returned 4 [0284.231] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.231] lstrlenW (lpString=".doc") returned 4 [0284.231] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString=".docx") returned 5 [0284.231] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0284.231] lstrlenW (lpString=".pdf") returned 4 [0284.231] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0284.231] lstrlenW (lpString=".xls") returned 4 [0284.232] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0284.232] lstrlenW (lpString=".xlsx") returned 5 [0284.232] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0284.232] lstrlenW (lpString=".ppt") returned 4 [0284.232] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0284.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.232] lstrlenW (lpString=".zip") returned 4 [0284.232] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0284.232] lstrlenW (lpString=".rar") returned 4 [0284.232] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0284.232] lstrlenW (lpString=".bz2") returned 4 [0284.232] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0284.232] lstrlenW (lpString=".7z") returned 3 [0284.232] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0284.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.232] lstrlenW (lpString=".dbf") returned 4 [0284.232] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0284.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.232] lstrlenW (lpString=".1cd") returned 4 [0284.232] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0284.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0284.232] lstrlenW (lpString=".jpg") returned 4 [0284.232] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0284.232] lstrcmpiW (lpString1=".TTF", lpString2=".drweb") returned 1 [0284.232] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0284.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0284.233] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=7656) returned 1 [0284.233] CloseHandle (hObject=0x210) returned 1 [0284.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0284.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0284.233] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.233] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0284.234] GetLastError () returned 0x0 [0284.234] ReadFile (in: hFile=0x210, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0284.372] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0284.373] ReadFile (in: hFile=0x210, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.373] WriteFile (in: hFile=0x1e4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xea, lpOverlapped=0x0) returned 1 [0284.373] SetEndOfFile (hFile=0x1e4) returned 1 [0284.373] CloseHandle (hObject=0x1e4) returned 1 [0284.373] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.373] SetEndOfFile (hFile=0x210) returned 1 [0284.374] CloseHandle (hObject=0x210) returned 1 [0284.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0284.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.374] lstrlenW (lpString=".doc") returned 4 [0284.374] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0284.374] lstrlenW (lpString=".docx") returned 5 [0284.375] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0284.375] lstrlenW (lpString=".pdf") returned 4 [0284.375] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString=".xls") returned 4 [0284.375] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0284.375] lstrlenW (lpString=".xlsx") returned 5 [0284.375] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0284.375] lstrlenW (lpString=".ppt") returned 4 [0284.375] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.375] lstrlenW (lpString=".zip") returned 4 [0284.375] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0284.375] lstrlenW (lpString=".rar") returned 4 [0284.375] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString=".bz2") returned 4 [0284.375] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString=".7z") returned 3 [0284.375] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0284.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.375] lstrlenW (lpString=".dbf") returned 4 [0284.375] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.375] lstrlenW (lpString=".1cd") returned 4 [0284.375] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.375] lstrlenW (lpString=".jpg") returned 4 [0284.375] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.375] lstrlenW (lpString=".doc") returned 4 [0284.375] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString=".docx") returned 5 [0284.375] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0284.375] lstrlenW (lpString=".pdf") returned 4 [0284.375] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0284.375] lstrlenW (lpString=".xls") returned 4 [0284.376] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0284.376] lstrlenW (lpString=".xlsx") returned 5 [0284.376] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0284.376] lstrlenW (lpString=".ppt") returned 4 [0284.376] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0284.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.376] lstrlenW (lpString=".zip") returned 4 [0284.376] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0284.376] lstrlenW (lpString=".rar") returned 4 [0284.376] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0284.376] lstrlenW (lpString=".bz2") returned 4 [0284.376] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0284.376] lstrlenW (lpString=".7z") returned 3 [0284.376] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0284.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.376] lstrlenW (lpString=".dbf") returned 4 [0284.376] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0284.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.376] lstrlenW (lpString=".1cd") returned 4 [0284.376] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0284.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0284.376] lstrlenW (lpString=".jpg") returned 4 [0284.376] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0284.377] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0284.377] lstrlenW (lpString="offfiltx.dll") returned 12 [0284.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0284.635] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=1486736) returned 1 [0284.636] CloseHandle (hObject=0x1c8) returned 1 [0284.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0284.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0284.637] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.637] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.843] GetLastError () returned 0x0 [0284.844] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0284.865] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0285.005] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0285.021] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0285.039] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.039] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.039] SetEndOfFile (hFile=0x1c4) returned 1 [0285.039] CloseHandle (hObject=0x1c4) returned 1 [0285.040] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.040] SetEndOfFile (hFile=0x1c8) returned 1 [0285.048] CloseHandle (hObject=0x1c8) returned 1 [0285.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0285.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.049] lstrlenW (lpString=".doc") returned 4 [0285.049] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.049] lstrlenW (lpString=".docx") returned 5 [0285.049] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0285.049] lstrlenW (lpString=".pdf") returned 4 [0285.049] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.049] lstrlenW (lpString=".xls") returned 4 [0285.049] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.049] lstrlenW (lpString=".xlsx") returned 5 [0285.049] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0285.049] lstrlenW (lpString=".ppt") returned 4 [0285.049] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.049] lstrlenW (lpString=".zip") returned 4 [0285.049] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.049] lstrlenW (lpString=".rar") returned 4 [0285.049] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.049] lstrlenW (lpString=".bz2") returned 4 [0285.049] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.049] lstrlenW (lpString=".7z") returned 3 [0285.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString=".dbf") returned 4 [0285.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString=".1cd") returned 4 [0285.050] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString=".jpg") returned 4 [0285.050] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString=".doc") returned 4 [0285.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString=".docx") returned 5 [0285.050] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0285.050] lstrlenW (lpString=".pdf") returned 4 [0285.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString=".xls") returned 4 [0285.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString=".xlsx") returned 5 [0285.050] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0285.050] lstrlenW (lpString=".ppt") returned 4 [0285.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString=".zip") returned 4 [0285.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString=".rar") returned 4 [0285.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.050] lstrlenW (lpString=".bz2") returned 4 [0285.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.050] lstrlenW (lpString=".7z") returned 3 [0285.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.050] lstrlenW (lpString=".dbf") returned 4 [0285.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.051] lstrlenW (lpString=".1cd") returned 4 [0285.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0285.051] lstrlenW (lpString=".jpg") returned 4 [0285.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.051] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0285.051] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0285.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0285.109] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=241024) returned 1 [0285.109] CloseHandle (hObject=0x1c8) returned 1 [0285.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0285.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0285.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.110] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0285.110] GetLastError () returned 0x0 [0285.110] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0285.118] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0285.121] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.121] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.122] SetEndOfFile (hFile=0x1f0) returned 1 [0285.122] CloseHandle (hObject=0x1f0) returned 1 [0285.122] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.122] SetEndOfFile (hFile=0x1c8) returned 1 [0285.124] CloseHandle (hObject=0x1c8) returned 1 [0285.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.124] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0285.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.124] lstrlenW (lpString=".doc") returned 4 [0285.124] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.124] lstrlenW (lpString=".docx") returned 5 [0285.124] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.124] lstrlenW (lpString=".pdf") returned 4 [0285.125] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.125] lstrlenW (lpString=".xls") returned 4 [0285.125] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.125] lstrlenW (lpString=".xlsx") returned 5 [0285.125] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.125] lstrlenW (lpString=".ppt") returned 4 [0285.125] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.125] lstrlenW (lpString=".zip") returned 4 [0285.125] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.125] lstrlenW (lpString=".rar") returned 4 [0285.125] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.125] lstrlenW (lpString=".bz2") returned 4 [0285.125] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.125] lstrlenW (lpString=".7z") returned 3 [0285.125] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.125] lstrlenW (lpString=".dbf") returned 4 [0285.126] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.126] lstrlenW (lpString=".1cd") returned 4 [0285.126] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.126] lstrlenW (lpString=".jpg") returned 4 [0285.126] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.126] lstrlenW (lpString=".doc") returned 4 [0285.126] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.126] lstrlenW (lpString=".docx") returned 5 [0285.126] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.126] lstrlenW (lpString=".pdf") returned 4 [0285.126] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.126] lstrlenW (lpString=".xls") returned 4 [0285.126] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.126] lstrlenW (lpString=".xlsx") returned 5 [0285.126] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.126] lstrlenW (lpString=".ppt") returned 4 [0285.126] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.126] lstrlenW (lpString=".zip") returned 4 [0285.126] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.126] lstrlenW (lpString=".rar") returned 4 [0285.126] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.126] lstrlenW (lpString=".bz2") returned 4 [0285.126] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.126] lstrlenW (lpString=".7z") returned 3 [0285.126] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.126] lstrlenW (lpString=".dbf") returned 4 [0285.126] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.127] lstrlenW (lpString=".1cd") returned 4 [0285.127] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0285.127] lstrlenW (lpString=".jpg") returned 4 [0285.127] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.127] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0285.127] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0285.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0285.127] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=73080) returned 1 [0285.127] CloseHandle (hObject=0x1c8) returned 1 [0285.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0285.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0285.128] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.128] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0285.128] GetLastError () returned 0x0 [0285.128] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0285.134] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0285.136] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.136] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.136] SetEndOfFile (hFile=0x1f0) returned 1 [0285.136] CloseHandle (hObject=0x1f0) returned 1 [0285.136] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.136] SetEndOfFile (hFile=0x1c8) returned 1 [0285.137] CloseHandle (hObject=0x1c8) returned 1 [0285.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.138] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0285.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.138] lstrlenW (lpString=".doc") returned 4 [0285.138] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.138] lstrlenW (lpString=".docx") returned 5 [0285.138] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.138] lstrlenW (lpString=".pdf") returned 4 [0285.138] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.138] lstrlenW (lpString=".xls") returned 4 [0285.138] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.138] lstrlenW (lpString=".xlsx") returned 5 [0285.138] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.138] lstrlenW (lpString=".ppt") returned 4 [0285.138] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.138] lstrlenW (lpString=".zip") returned 4 [0285.138] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.138] lstrlenW (lpString=".rar") returned 4 [0285.138] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.138] lstrlenW (lpString=".bz2") returned 4 [0285.138] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.139] lstrlenW (lpString=".7z") returned 3 [0285.139] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString=".dbf") returned 4 [0285.139] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString=".1cd") returned 4 [0285.139] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString=".jpg") returned 4 [0285.139] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString=".doc") returned 4 [0285.139] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.139] lstrlenW (lpString=".docx") returned 5 [0285.139] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.139] lstrlenW (lpString=".pdf") returned 4 [0285.139] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.139] lstrlenW (lpString=".xls") returned 4 [0285.139] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.139] lstrlenW (lpString=".xlsx") returned 5 [0285.139] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.139] lstrlenW (lpString=".ppt") returned 4 [0285.139] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString=".zip") returned 4 [0285.139] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.139] lstrlenW (lpString=".rar") returned 4 [0285.139] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.139] lstrlenW (lpString=".bz2") returned 4 [0285.139] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.139] lstrlenW (lpString=".7z") returned 3 [0285.139] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.139] lstrlenW (lpString=".dbf") returned 4 [0285.139] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.140] lstrlenW (lpString=".1cd") returned 4 [0285.140] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0285.140] lstrlenW (lpString=".jpg") returned 4 [0285.140] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.140] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0285.140] lstrlenW (lpString="PNG32.FLT") returned 9 [0285.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0285.140] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=302976) returned 1 [0285.140] CloseHandle (hObject=0x1c8) returned 1 [0285.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0285.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0285.141] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.141] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0285.141] GetLastError () returned 0x0 [0285.141] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0285.183] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0285.270] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.270] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0285.270] SetEndOfFile (hFile=0x1f0) returned 1 [0285.344] CloseHandle (hObject=0x1f0) returned 1 [0285.344] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.344] SetEndOfFile (hFile=0x1c8) returned 1 [0285.348] CloseHandle (hObject=0x1c8) returned 1 [0285.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0285.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.423] lstrlenW (lpString=".doc") returned 4 [0285.423] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.423] lstrlenW (lpString=".docx") returned 5 [0285.423] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.423] lstrlenW (lpString=".pdf") returned 4 [0285.423] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.423] lstrlenW (lpString=".xls") returned 4 [0285.423] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.423] lstrlenW (lpString=".xlsx") returned 5 [0285.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.423] lstrlenW (lpString=".ppt") returned 4 [0285.423] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.423] lstrlenW (lpString=".zip") returned 4 [0285.424] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.424] lstrlenW (lpString=".rar") returned 4 [0285.424] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.424] lstrlenW (lpString=".bz2") returned 4 [0285.424] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.424] lstrlenW (lpString=".7z") returned 3 [0285.424] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.424] lstrlenW (lpString=".dbf") returned 4 [0285.424] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.424] lstrlenW (lpString=".1cd") returned 4 [0285.424] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.424] lstrlenW (lpString=".jpg") returned 4 [0285.424] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.424] lstrlenW (lpString=".doc") returned 4 [0285.424] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.424] lstrlenW (lpString=".docx") returned 5 [0285.424] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.424] lstrlenW (lpString=".pdf") returned 4 [0285.425] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.445] lstrlenW (lpString=".xls") returned 4 [0285.445] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.445] lstrlenW (lpString=".xlsx") returned 5 [0285.445] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.445] lstrlenW (lpString=".ppt") returned 4 [0285.445] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.445] lstrlenW (lpString=".zip") returned 4 [0285.445] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.445] lstrlenW (lpString=".rar") returned 4 [0285.445] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.445] lstrlenW (lpString=".bz2") returned 4 [0285.445] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.445] lstrlenW (lpString=".7z") returned 3 [0285.445] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.445] lstrlenW (lpString=".dbf") returned 4 [0285.445] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.445] lstrlenW (lpString=".1cd") returned 4 [0285.445] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0285.445] lstrlenW (lpString=".jpg") returned 4 [0285.445] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.446] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0285.446] lstrlenW (lpString="hxds.dll") returned 8 [0285.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0285.502] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=1257984) returned 1 [0285.502] CloseHandle (hObject=0x1e4) returned 1 [0285.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0285.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0285.503] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.503] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0285.503] GetLastError () returned 0x0 [0285.503] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0285.774] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0286.006] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x33210, lpOverlapped=0x0) returned 1 [0286.037] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x33220, lpOverlapped=0x0) returned 1 [0286.046] ReadFile (in: hFile=0x1e4, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.046] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0286.046] SetEndOfFile (hFile=0x1b0) returned 1 [0286.046] CloseHandle (hObject=0x1b0) returned 1 [0286.046] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.046] SetEndOfFile (hFile=0x1e4) returned 1 [0286.050] CloseHandle (hObject=0x1e4) returned 1 [0286.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0286.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.051] lstrlenW (lpString=".doc") returned 4 [0286.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.051] lstrlenW (lpString=".docx") returned 5 [0286.051] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0286.051] lstrlenW (lpString=".pdf") returned 4 [0286.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.051] lstrlenW (lpString=".xls") returned 4 [0286.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.051] lstrlenW (lpString=".xlsx") returned 5 [0286.051] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0286.051] lstrlenW (lpString=".ppt") returned 4 [0286.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.051] lstrlenW (lpString=".zip") returned 4 [0286.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.051] lstrlenW (lpString=".rar") returned 4 [0286.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString=".bz2") returned 4 [0286.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.052] lstrlenW (lpString=".7z") returned 3 [0286.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.052] lstrlenW (lpString=".dbf") returned 4 [0286.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.052] lstrlenW (lpString=".1cd") returned 4 [0286.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.052] lstrlenW (lpString=".jpg") returned 4 [0286.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.052] lstrlenW (lpString=".doc") returned 4 [0286.052] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString=".docx") returned 5 [0286.052] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0286.052] lstrlenW (lpString=".pdf") returned 4 [0286.052] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString=".xls") returned 4 [0286.052] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0286.052] lstrlenW (lpString=".xlsx") returned 5 [0286.052] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0286.052] lstrlenW (lpString=".ppt") returned 4 [0286.052] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.053] lstrlenW (lpString=".zip") returned 4 [0286.053] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString=".rar") returned 4 [0286.053] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0286.053] lstrlenW (lpString=".bz2") returned 4 [0286.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0286.053] lstrlenW (lpString=".7z") returned 3 [0286.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.053] lstrlenW (lpString=".dbf") returned 4 [0286.053] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.053] lstrlenW (lpString=".1cd") returned 4 [0286.053] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0286.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0286.053] lstrlenW (lpString=".jpg") returned 4 [0286.053] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0286.053] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.053] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0286.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.591] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=9216) returned 1 [0286.591] CloseHandle (hObject=0x1f8) returned 1 [0286.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0286.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.591] lstrlenW (lpString=".doc") returned 4 [0286.591] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.591] lstrlenW (lpString=".docx") returned 5 [0286.592] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.592] lstrlenW (lpString=".pdf") returned 4 [0286.592] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.592] lstrlenW (lpString=".xls") returned 4 [0286.592] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.592] lstrlenW (lpString=".xlsx") returned 5 [0286.592] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.592] lstrlenW (lpString=".ppt") returned 4 [0286.592] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.592] lstrlenW (lpString=".zip") returned 4 [0286.592] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.592] lstrlenW (lpString=".rar") returned 4 [0286.592] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.592] lstrlenW (lpString=".bz2") returned 4 [0286.592] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.592] lstrlenW (lpString=".7z") returned 3 [0286.592] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.592] lstrlenW (lpString=".dbf") returned 4 [0286.592] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.592] lstrlenW (lpString=".1cd") returned 4 [0286.592] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.592] lstrlenW (lpString=".jpg") returned 4 [0286.592] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.592] lstrlenW (lpString=".doc") returned 4 [0286.592] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.592] lstrlenW (lpString=".docx") returned 5 [0286.592] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.593] lstrlenW (lpString=".pdf") returned 4 [0286.593] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.593] lstrlenW (lpString=".xls") returned 4 [0286.593] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.593] lstrlenW (lpString=".xlsx") returned 5 [0286.593] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.593] lstrlenW (lpString=".ppt") returned 4 [0286.593] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.593] lstrlenW (lpString=".zip") returned 4 [0286.593] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.593] lstrlenW (lpString=".rar") returned 4 [0286.593] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.593] lstrlenW (lpString=".bz2") returned 4 [0286.593] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.593] lstrlenW (lpString=".7z") returned 3 [0286.593] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.593] lstrlenW (lpString=".dbf") returned 4 [0286.593] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.593] lstrlenW (lpString=".1cd") returned 4 [0286.593] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0286.593] lstrlenW (lpString=".jpg") returned 4 [0286.593] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.593] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.594] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0286.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.595] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=22528) returned 1 [0286.595] CloseHandle (hObject=0x1f8) returned 1 [0286.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0286.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.595] lstrlenW (lpString=".doc") returned 4 [0286.595] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.595] lstrlenW (lpString=".docx") returned 5 [0286.595] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.595] lstrlenW (lpString=".pdf") returned 4 [0286.595] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.595] lstrlenW (lpString=".xls") returned 4 [0286.595] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.595] lstrlenW (lpString=".xlsx") returned 5 [0286.595] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.595] lstrlenW (lpString=".ppt") returned 4 [0286.595] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.595] lstrlenW (lpString=".zip") returned 4 [0286.595] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.595] lstrlenW (lpString=".rar") returned 4 [0286.595] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.595] lstrlenW (lpString=".bz2") returned 4 [0286.595] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.596] lstrlenW (lpString=".7z") returned 3 [0286.596] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString=".dbf") returned 4 [0286.596] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString=".1cd") returned 4 [0286.596] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString=".jpg") returned 4 [0286.596] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString=".doc") returned 4 [0286.596] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.596] lstrlenW (lpString=".docx") returned 5 [0286.596] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.596] lstrlenW (lpString=".pdf") returned 4 [0286.596] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.596] lstrlenW (lpString=".xls") returned 4 [0286.596] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.596] lstrlenW (lpString=".xlsx") returned 5 [0286.596] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.596] lstrlenW (lpString=".ppt") returned 4 [0286.596] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString=".zip") returned 4 [0286.596] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.596] lstrlenW (lpString=".rar") returned 4 [0286.596] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.596] lstrlenW (lpString=".bz2") returned 4 [0286.596] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.596] lstrlenW (lpString=".7z") returned 3 [0286.596] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.596] lstrlenW (lpString=".dbf") returned 4 [0286.597] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.597] lstrlenW (lpString=".1cd") returned 4 [0286.597] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0286.597] lstrlenW (lpString=".jpg") returned 4 [0286.597] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.597] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.597] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0286.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.597] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=2560) returned 1 [0286.597] CloseHandle (hObject=0x1f8) returned 1 [0286.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0286.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString=".doc") returned 4 [0286.598] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.598] lstrlenW (lpString=".docx") returned 5 [0286.598] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.598] lstrlenW (lpString=".pdf") returned 4 [0286.598] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.598] lstrlenW (lpString=".xls") returned 4 [0286.598] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.598] lstrlenW (lpString=".xlsx") returned 5 [0286.598] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.598] lstrlenW (lpString=".ppt") returned 4 [0286.598] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString=".zip") returned 4 [0286.598] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.598] lstrlenW (lpString=".rar") returned 4 [0286.598] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.598] lstrlenW (lpString=".bz2") returned 4 [0286.598] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.598] lstrlenW (lpString=".7z") returned 3 [0286.598] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString=".dbf") returned 4 [0286.598] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString=".1cd") returned 4 [0286.598] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString=".jpg") returned 4 [0286.598] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.598] lstrlenW (lpString=".doc") returned 4 [0286.598] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.598] lstrlenW (lpString=".docx") returned 5 [0286.598] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.599] lstrlenW (lpString=".pdf") returned 4 [0286.599] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.599] lstrlenW (lpString=".xls") returned 4 [0286.599] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.599] lstrlenW (lpString=".xlsx") returned 5 [0286.599] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.599] lstrlenW (lpString=".ppt") returned 4 [0286.599] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.599] lstrlenW (lpString=".zip") returned 4 [0286.599] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.599] lstrlenW (lpString=".rar") returned 4 [0286.599] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.599] lstrlenW (lpString=".bz2") returned 4 [0286.599] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.599] lstrlenW (lpString=".7z") returned 3 [0286.599] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.599] lstrlenW (lpString=".dbf") returned 4 [0286.599] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.599] lstrlenW (lpString=".1cd") returned 4 [0286.599] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0286.599] lstrlenW (lpString=".jpg") returned 4 [0286.599] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.599] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.599] lstrlenW (lpString="micaut.dll.mui") returned 14 [0286.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.601] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=8704) returned 1 [0286.601] CloseHandle (hObject=0x1f8) returned 1 [0286.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0286.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.602] lstrlenW (lpString=".doc") returned 4 [0286.602] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.602] lstrlenW (lpString=".docx") returned 5 [0286.602] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.602] lstrlenW (lpString=".pdf") returned 4 [0286.602] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.602] lstrlenW (lpString=".xls") returned 4 [0286.602] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.602] lstrlenW (lpString=".xlsx") returned 5 [0286.602] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.602] lstrlenW (lpString=".ppt") returned 4 [0286.602] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.602] lstrlenW (lpString=".zip") returned 4 [0286.602] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.602] lstrlenW (lpString=".rar") returned 4 [0286.602] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.602] lstrlenW (lpString=".bz2") returned 4 [0286.602] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.602] lstrlenW (lpString=".7z") returned 3 [0286.602] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.602] lstrlenW (lpString=".dbf") returned 4 [0286.602] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.602] lstrlenW (lpString=".1cd") returned 4 [0286.602] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.602] lstrlenW (lpString=".jpg") returned 4 [0286.602] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.603] lstrlenW (lpString=".doc") returned 4 [0286.603] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.603] lstrlenW (lpString=".docx") returned 5 [0286.603] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.603] lstrlenW (lpString=".pdf") returned 4 [0286.603] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.603] lstrlenW (lpString=".xls") returned 4 [0286.603] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.603] lstrlenW (lpString=".xlsx") returned 5 [0286.603] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.603] lstrlenW (lpString=".ppt") returned 4 [0286.603] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.603] lstrlenW (lpString=".zip") returned 4 [0286.603] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.603] lstrlenW (lpString=".rar") returned 4 [0286.603] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.603] lstrlenW (lpString=".bz2") returned 4 [0286.603] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.603] lstrlenW (lpString=".7z") returned 3 [0286.603] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.604] lstrlenW (lpString=".dbf") returned 4 [0286.604] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.604] lstrlenW (lpString=".1cd") returned 4 [0286.604] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0286.605] lstrlenW (lpString=".jpg") returned 4 [0286.605] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.605] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.605] lstrlenW (lpString="mip.exe.mui") returned 11 [0286.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.605] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=10240) returned 1 [0286.605] CloseHandle (hObject=0x1f8) returned 1 [0286.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0286.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.606] lstrlenW (lpString=".doc") returned 4 [0286.606] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.606] lstrlenW (lpString=".docx") returned 5 [0286.606] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.606] lstrlenW (lpString=".pdf") returned 4 [0286.606] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.606] lstrlenW (lpString=".xls") returned 4 [0286.606] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.606] lstrlenW (lpString=".xlsx") returned 5 [0286.606] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.606] lstrlenW (lpString=".ppt") returned 4 [0286.606] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.606] lstrlenW (lpString=".zip") returned 4 [0286.606] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.606] lstrlenW (lpString=".rar") returned 4 [0286.606] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.606] lstrlenW (lpString=".bz2") returned 4 [0286.606] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.606] lstrlenW (lpString=".7z") returned 3 [0286.606] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.606] lstrlenW (lpString=".dbf") returned 4 [0286.606] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString=".1cd") returned 4 [0286.607] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString=".jpg") returned 4 [0286.607] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString=".doc") returned 4 [0286.607] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.607] lstrlenW (lpString=".docx") returned 5 [0286.607] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0286.607] lstrlenW (lpString=".pdf") returned 4 [0286.607] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.607] lstrlenW (lpString=".xls") returned 4 [0286.607] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.607] lstrlenW (lpString=".xlsx") returned 5 [0286.607] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0286.607] lstrlenW (lpString=".ppt") returned 4 [0286.607] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString=".zip") returned 4 [0286.607] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.607] lstrlenW (lpString=".rar") returned 4 [0286.607] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.607] lstrlenW (lpString=".bz2") returned 4 [0286.607] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.607] lstrlenW (lpString=".7z") returned 3 [0286.607] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString=".dbf") returned 4 [0286.607] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.607] lstrlenW (lpString=".1cd") returned 4 [0286.607] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0286.608] lstrlenW (lpString=".jpg") returned 4 [0286.608] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.608] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.608] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0286.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.609] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=2560) returned 1 [0286.609] CloseHandle (hObject=0x1f8) returned 1 [0286.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0286.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0286.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0286.616] lstrlenW (lpString=".doc") returned 4 [0286.616] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.616] lstrlenW (lpString=".docx") returned 5 [0286.616] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.616] lstrlenW (lpString=".pdf") returned 4 [0286.616] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.616] lstrlenW (lpString=".xls") returned 4 [0286.616] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.616] lstrlenW (lpString=".xlsx") returned 5 [0286.616] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.616] lstrlenW (lpString=".ppt") returned 4 [0286.616] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0286.616] lstrlenW (lpString=".zip") returned 4 [0286.617] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.617] lstrlenW (lpString=".rar") returned 4 [0286.617] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.617] lstrlenW (lpString=".bz2") returned 4 [0286.617] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.617] lstrlenW (lpString=".7z") returned 3 [0286.617] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0286.617] lstrlenW (lpString=".dbf") returned 4 [0286.617] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0286.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0286.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0286.725] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.725] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0287.142] GetLastError () returned 0x0 [0287.142] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0287.224] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0287.232] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.232] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0287.232] SetEndOfFile (hFile=0x1c0) returned 1 [0287.232] CloseHandle (hObject=0x1c0) returned 1 [0287.232] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.232] SetEndOfFile (hFile=0x1dc) returned 1 [0287.237] CloseHandle (hObject=0x1dc) returned 1 [0287.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0287.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.239] lstrlenW (lpString=".doc") returned 4 [0287.239] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0287.239] lstrlenW (lpString=".docx") returned 5 [0287.239] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0287.239] lstrlenW (lpString=".pdf") returned 4 [0287.239] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0287.239] lstrlenW (lpString=".xls") returned 4 [0287.239] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0287.239] lstrlenW (lpString=".xlsx") returned 5 [0287.239] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0287.239] lstrlenW (lpString=".ppt") returned 4 [0287.239] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0287.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.239] lstrlenW (lpString=".zip") returned 4 [0287.239] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0287.239] lstrlenW (lpString=".rar") returned 4 [0287.239] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0287.239] lstrlenW (lpString=".bz2") returned 4 [0287.239] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0287.239] lstrlenW (lpString=".7z") returned 3 [0287.239] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0287.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.239] lstrlenW (lpString=".dbf") returned 4 [0287.240] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0287.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.240] lstrlenW (lpString=".1cd") returned 4 [0287.240] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0287.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.240] lstrlenW (lpString=".jpg") returned 4 [0287.240] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.240] lstrlenW (lpString=".doc") returned 4 [0287.240] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString=".docx") returned 5 [0287.240] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0287.240] lstrlenW (lpString=".pdf") returned 4 [0287.240] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString=".xls") returned 4 [0287.240] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString=".xlsx") returned 5 [0287.240] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0287.240] lstrlenW (lpString=".ppt") returned 4 [0287.240] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.240] lstrlenW (lpString=".zip") returned 4 [0287.240] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString=".rar") returned 4 [0287.240] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0287.240] lstrlenW (lpString=".bz2") returned 4 [0287.241] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0287.241] lstrlenW (lpString=".7z") returned 3 [0287.241] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0287.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.241] lstrlenW (lpString=".dbf") returned 4 [0287.241] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0287.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.241] lstrlenW (lpString=".1cd") returned 4 [0287.241] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0287.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0287.241] lstrlenW (lpString=".jpg") returned 4 [0287.241] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0287.241] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0287.241] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0287.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0287.242] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=862608) returned 1 [0287.242] CloseHandle (hObject=0x1dc) returned 1 [0287.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0287.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0287.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0287.242] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.242] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0287.243] GetLastError () returned 0x0 [0287.243] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0xd2990, lpOverlapped=0x0) returned 1 [0287.552] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0287.569] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.569] WriteFile (in: hFile=0x1c0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x304fc9c*=0xea, lpOverlapped=0x0) returned 1 [0287.569] SetEndOfFile (hFile=0x1c0) Thread: id = 15 os_tid = 0x578 [0260.796] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38d06a0 [0260.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38e06a8 [0260.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330570 [0260.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x333250 [0260.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x330588 [0260.797] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3cb0020 [0260.798] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3305a0 [0260.798] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3305a0, Size=0x20) returned 0x35fad8 [0260.798] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3305a0 [0260.798] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3305a0, Size=0x20) returned 0x35fb00 [0260.798] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.798] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.798] Wow64DisableWow64FsRedirection (in: OldValue=0x318ff58 | out: OldValue=0x318ff58*=0x0) returned 1 [0260.798] lstrlenW (lpString="kernel32.dll") returned 12 [0260.798] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.799] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.799] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.799] Sleep (dwMilliseconds=0x64) [0261.580] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.581] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0261.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0261.897] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1565) returned 1 [0261.897] CloseHandle (hObject=0x170) returned 1 [0261.897] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0261.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0261.898] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.898] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0261.898] GetLastError () returned 0x0 [0261.898] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x61d, lpOverlapped=0x0) returned 1 [0261.990] WriteFile (in: hFile=0x184, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x620, lpOverlapped=0x0) returned 1 [0261.991] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.992] WriteFile (in: hFile=0x184, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.992] SetEndOfFile (hFile=0x184) returned 1 [0261.992] CloseHandle (hObject=0x184) returned 1 [0261.993] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.993] SetEndOfFile (hFile=0x170) returned 1 [0261.994] CloseHandle (hObject=0x170) returned 1 [0261.994] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0261.994] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0261.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.994] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.994] lstrlenW (lpString=".doc") returned 4 [0261.994] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.994] lstrlenW (lpString=".docx") returned 5 [0261.994] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0261.994] lstrlenW (lpString=".pdf") returned 4 [0261.994] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.994] lstrlenW (lpString=".xls") returned 4 [0261.995] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString=".xlsx") returned 5 [0261.995] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0261.995] lstrlenW (lpString=".ppt") returned 4 [0261.995] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.995] lstrlenW (lpString=".zip") returned 4 [0261.995] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.995] lstrlenW (lpString=".rar") returned 4 [0261.995] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString=".bz2") returned 4 [0261.995] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString=".7z") returned 3 [0261.995] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.995] lstrlenW (lpString=".dbf") returned 4 [0261.995] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.995] lstrlenW (lpString=".1cd") returned 4 [0261.995] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.995] lstrlenW (lpString=".jpg") returned 4 [0261.995] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.996] lstrlenW (lpString=".doc") returned 4 [0261.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString=".docx") returned 5 [0261.996] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0261.996] lstrlenW (lpString=".pdf") returned 4 [0261.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString=".xls") returned 4 [0261.996] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString=".xlsx") returned 5 [0261.996] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0261.996] lstrlenW (lpString=".ppt") returned 4 [0261.996] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.996] lstrlenW (lpString=".zip") returned 4 [0261.996] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0261.996] lstrlenW (lpString=".rar") returned 4 [0261.996] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString=".bz2") returned 4 [0261.996] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString=".7z") returned 3 [0261.996] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.996] lstrlenW (lpString=".dbf") returned 4 [0261.996] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.996] lstrlenW (lpString=".1cd") returned 4 [0261.996] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0261.996] lstrlenW (lpString=".jpg") returned 4 [0261.996] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.997] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0261.997] lstrlenW (lpString="WordMUI.xml") returned 11 [0261.997] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.178] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1800) returned 1 [0262.178] CloseHandle (hObject=0x190) returned 1 [0262.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0262.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.178] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.178] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0262.179] GetLastError () returned 0x0 [0262.179] ReadFile (in: hFile=0x190, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x708, lpOverlapped=0x0) returned 1 [0262.206] WriteFile (in: hFile=0x194, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x710, lpOverlapped=0x0) returned 1 [0262.207] ReadFile (in: hFile=0x190, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.207] WriteFile (in: hFile=0x194, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.207] SetEndOfFile (hFile=0x194) returned 1 [0262.208] CloseHandle (hObject=0x194) returned 1 [0262.209] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.209] SetEndOfFile (hFile=0x190) returned 1 [0262.210] CloseHandle (hObject=0x190) returned 1 [0262.210] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.210] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0262.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.211] lstrlenW (lpString=".doc") returned 4 [0262.211] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString=".docx") returned 5 [0262.211] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.211] lstrlenW (lpString=".pdf") returned 4 [0262.211] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString=".xls") returned 4 [0262.211] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString=".xlsx") returned 5 [0262.211] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.211] lstrlenW (lpString=".ppt") returned 4 [0262.211] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.211] lstrlenW (lpString=".zip") returned 4 [0262.211] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.211] lstrlenW (lpString=".rar") returned 4 [0262.211] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString=".bz2") returned 4 [0262.211] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString=".7z") returned 3 [0262.211] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.211] lstrlenW (lpString=".dbf") returned 4 [0262.211] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.211] lstrlenW (lpString=".1cd") returned 4 [0262.211] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.212] lstrlenW (lpString=".jpg") returned 4 [0262.212] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.212] lstrlenW (lpString=".doc") returned 4 [0262.212] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString=".docx") returned 5 [0262.212] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0262.212] lstrlenW (lpString=".pdf") returned 4 [0262.212] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString=".xls") returned 4 [0262.212] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString=".xlsx") returned 5 [0262.212] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0262.212] lstrlenW (lpString=".ppt") returned 4 [0262.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.212] lstrlenW (lpString=".zip") returned 4 [0262.212] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.212] lstrlenW (lpString=".rar") returned 4 [0262.212] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString=".bz2") returned 4 [0262.212] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.212] lstrlenW (lpString=".7z") returned 3 [0262.212] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.212] lstrlenW (lpString=".dbf") returned 4 [0262.213] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.213] lstrlenW (lpString=".1cd") returned 4 [0262.213] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0262.213] lstrlenW (lpString=".jpg") returned 4 [0262.213] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.213] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.213] lstrlenW (lpString="Proof.xml") returned 9 [0262.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.256] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1347) returned 1 [0262.256] CloseHandle (hObject=0x170) returned 1 [0262.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0262.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.256] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.256] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.257] GetLastError () returned 0x0 [0262.257] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x543, lpOverlapped=0x0) returned 1 [0262.284] WriteFile (in: hFile=0x190, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x550, lpOverlapped=0x0) returned 1 [0262.286] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.286] WriteFile (in: hFile=0x190, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.286] SetEndOfFile (hFile=0x190) returned 1 [0262.286] CloseHandle (hObject=0x190) returned 1 [0262.287] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.287] SetEndOfFile (hFile=0x170) returned 1 [0262.288] CloseHandle (hObject=0x170) returned 1 [0262.288] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.288] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0262.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.288] lstrlenW (lpString=".doc") returned 4 [0262.288] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString=".docx") returned 5 [0262.289] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0262.289] lstrlenW (lpString=".pdf") returned 4 [0262.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString=".xls") returned 4 [0262.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString=".xlsx") returned 5 [0262.289] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0262.289] lstrlenW (lpString=".ppt") returned 4 [0262.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.289] lstrlenW (lpString=".zip") returned 4 [0262.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.289] lstrlenW (lpString=".rar") returned 4 [0262.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString=".bz2") returned 4 [0262.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString=".7z") returned 3 [0262.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.289] lstrlenW (lpString=".dbf") returned 4 [0262.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.289] lstrlenW (lpString=".1cd") returned 4 [0262.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.289] lstrlenW (lpString=".jpg") returned 4 [0262.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.290] lstrlenW (lpString=".doc") returned 4 [0262.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString=".docx") returned 5 [0262.290] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0262.290] lstrlenW (lpString=".pdf") returned 4 [0262.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString=".xls") returned 4 [0262.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString=".xlsx") returned 5 [0262.290] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0262.290] lstrlenW (lpString=".ppt") returned 4 [0262.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.290] lstrlenW (lpString=".zip") returned 4 [0262.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.290] lstrlenW (lpString=".rar") returned 4 [0262.290] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString=".bz2") returned 4 [0262.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString=".7z") returned 3 [0262.290] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.290] lstrlenW (lpString=".dbf") returned 4 [0262.290] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.290] lstrlenW (lpString=".1cd") returned 4 [0262.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0262.291] lstrlenW (lpString=".jpg") returned 4 [0262.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.291] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.291] lstrlenW (lpString="Proofing.xml") returned 12 [0262.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.291] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=811) returned 1 [0262.291] CloseHandle (hObject=0x170) returned 1 [0262.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0262.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.292] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.292] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.292] GetLastError () returned 0x0 [0262.292] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x32b, lpOverlapped=0x0) returned 1 [0262.294] WriteFile (in: hFile=0x190, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x330, lpOverlapped=0x0) returned 1 [0262.295] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.295] WriteFile (in: hFile=0x190, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.295] SetEndOfFile (hFile=0x190) returned 1 [0262.295] CloseHandle (hObject=0x190) returned 1 [0262.296] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.296] SetEndOfFile (hFile=0x170) returned 1 [0262.297] CloseHandle (hObject=0x170) returned 1 [0262.297] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.297] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0262.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.298] lstrlenW (lpString=".doc") returned 4 [0262.298] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString=".docx") returned 5 [0262.298] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0262.298] lstrlenW (lpString=".pdf") returned 4 [0262.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString=".xls") returned 4 [0262.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString=".xlsx") returned 5 [0262.298] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0262.298] lstrlenW (lpString=".ppt") returned 4 [0262.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.298] lstrlenW (lpString=".zip") returned 4 [0262.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.298] lstrlenW (lpString=".rar") returned 4 [0262.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString=".bz2") returned 4 [0262.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString=".7z") returned 3 [0262.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.298] lstrlenW (lpString=".dbf") returned 4 [0262.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.298] lstrlenW (lpString=".1cd") returned 4 [0262.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.299] lstrlenW (lpString=".jpg") returned 4 [0262.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.299] lstrlenW (lpString=".doc") returned 4 [0262.299] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString=".docx") returned 5 [0262.299] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0262.299] lstrlenW (lpString=".pdf") returned 4 [0262.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString=".xls") returned 4 [0262.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString=".xlsx") returned 5 [0262.299] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0262.299] lstrlenW (lpString=".ppt") returned 4 [0262.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.299] lstrlenW (lpString=".zip") returned 4 [0262.299] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.299] lstrlenW (lpString=".rar") returned 4 [0262.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString=".bz2") returned 4 [0262.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.299] lstrlenW (lpString=".7z") returned 3 [0262.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.299] lstrlenW (lpString=".dbf") returned 4 [0262.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.300] lstrlenW (lpString=".1cd") returned 4 [0262.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0262.300] lstrlenW (lpString=".jpg") returned 4 [0262.300] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.300] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.300] lstrlenW (lpString="Setup.xml") returned 9 [0262.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.300] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=5884) returned 1 [0262.300] CloseHandle (hObject=0x170) returned 1 [0262.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0262.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0262.301] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.301] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0262.301] GetLastError () returned 0x0 [0262.301] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0262.312] WriteFile (in: hFile=0x190, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0262.313] ReadFile (in: hFile=0x170, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.313] WriteFile (in: hFile=0x190, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0262.314] SetEndOfFile (hFile=0x190) returned 1 [0262.314] CloseHandle (hObject=0x190) returned 1 [0262.314] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.315] SetEndOfFile (hFile=0x170) returned 1 [0262.315] CloseHandle (hObject=0x170) returned 1 [0262.316] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.316] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0262.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.316] lstrlenW (lpString=".doc") returned 4 [0262.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.316] lstrlenW (lpString=".docx") returned 5 [0262.316] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.316] lstrlenW (lpString=".pdf") returned 4 [0262.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.316] lstrlenW (lpString=".xls") returned 4 [0262.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.316] lstrlenW (lpString=".xlsx") returned 5 [0262.317] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.317] lstrlenW (lpString=".ppt") returned 4 [0262.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.317] lstrlenW (lpString=".zip") returned 4 [0262.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.317] lstrlenW (lpString=".rar") returned 4 [0262.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.317] lstrlenW (lpString=".bz2") returned 4 [0262.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.317] lstrlenW (lpString=".7z") returned 3 [0262.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.317] lstrlenW (lpString=".dbf") returned 4 [0262.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.317] lstrlenW (lpString=".1cd") returned 4 [0262.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.317] lstrlenW (lpString=".jpg") returned 4 [0262.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.713] lstrlenW (lpString=".doc") returned 4 [0262.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString=".docx") returned 5 [0262.713] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0262.713] lstrlenW (lpString=".pdf") returned 4 [0262.713] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString=".xls") returned 4 [0262.713] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString=".xlsx") returned 5 [0262.713] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0262.713] lstrlenW (lpString=".ppt") returned 4 [0262.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.713] lstrlenW (lpString=".zip") returned 4 [0262.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0262.713] lstrlenW (lpString=".rar") returned 4 [0262.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString=".bz2") returned 4 [0262.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0262.713] lstrlenW (lpString=".7z") returned 3 [0262.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0262.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.714] lstrlenW (lpString=".dbf") returned 4 [0262.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0262.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.714] lstrlenW (lpString=".1cd") returned 4 [0262.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0262.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0262.714] lstrlenW (lpString=".jpg") returned 4 [0262.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0262.714] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0262.714] lstrlenW (lpString="Setup.xml") returned 9 [0262.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.092] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1988) returned 1 [0263.092] CloseHandle (hObject=0x1a8) returned 1 [0263.092] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0263.093] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.093] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.093] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0263.093] GetLastError () returned 0x0 [0263.093] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0263.282] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0263.283] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.283] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.283] SetEndOfFile (hFile=0x1ac) returned 1 [0263.283] CloseHandle (hObject=0x1ac) returned 1 [0263.284] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.284] SetEndOfFile (hFile=0x1a8) returned 1 [0263.285] CloseHandle (hObject=0x1a8) returned 1 [0263.285] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.285] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0263.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.285] lstrlenW (lpString=".doc") returned 4 [0263.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.285] lstrlenW (lpString=".docx") returned 5 [0263.285] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.286] lstrlenW (lpString=".pdf") returned 4 [0263.286] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString=".xls") returned 4 [0263.286] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString=".xlsx") returned 5 [0263.286] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.286] lstrlenW (lpString=".ppt") returned 4 [0263.286] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.286] lstrlenW (lpString=".zip") returned 4 [0263.286] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.286] lstrlenW (lpString=".rar") returned 4 [0263.286] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString=".bz2") returned 4 [0263.286] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString=".7z") returned 3 [0263.286] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.286] lstrlenW (lpString=".dbf") returned 4 [0263.286] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.286] lstrlenW (lpString=".1cd") returned 4 [0263.286] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.286] lstrlenW (lpString=".jpg") returned 4 [0263.286] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.286] lstrlenW (lpString=".doc") returned 4 [0263.286] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString=".docx") returned 5 [0263.286] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.286] lstrlenW (lpString=".pdf") returned 4 [0263.286] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.286] lstrlenW (lpString=".xls") returned 4 [0263.286] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.287] lstrlenW (lpString=".xlsx") returned 5 [0263.287] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.287] lstrlenW (lpString=".ppt") returned 4 [0263.287] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.287] lstrlenW (lpString=".zip") returned 4 [0263.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.287] lstrlenW (lpString=".rar") returned 4 [0263.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.287] lstrlenW (lpString=".bz2") returned 4 [0263.287] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.287] lstrlenW (lpString=".7z") returned 3 [0263.287] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.287] lstrlenW (lpString=".dbf") returned 4 [0263.287] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.287] lstrlenW (lpString=".1cd") returned 4 [0263.287] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.287] lstrlenW (lpString=".jpg") returned 4 [0263.287] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.287] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.287] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0263.287] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.288] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=5557) returned 1 [0263.288] CloseHandle (hObject=0x1a8) returned 1 [0263.288] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0263.288] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.288] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.288] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.288] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.288] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0263.288] GetLastError () returned 0x0 [0263.288] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0263.417] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0263.418] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.418] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xee, lpOverlapped=0x0) returned 1 [0263.418] SetEndOfFile (hFile=0x1ac) returned 1 [0263.421] CloseHandle (hObject=0x1ac) returned 1 [0263.421] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.421] SetEndOfFile (hFile=0x1a8) returned 1 [0263.422] CloseHandle (hObject=0x1a8) returned 1 [0263.422] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.422] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString=".doc") returned 4 [0263.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString=".docx") returned 5 [0263.423] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.423] lstrlenW (lpString=".pdf") returned 4 [0263.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString=".xls") returned 4 [0263.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString=".xlsx") returned 5 [0263.423] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.423] lstrlenW (lpString=".ppt") returned 4 [0263.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString=".zip") returned 4 [0263.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.423] lstrlenW (lpString=".rar") returned 4 [0263.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString=".bz2") returned 4 [0263.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString=".7z") returned 3 [0263.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString=".dbf") returned 4 [0263.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString=".1cd") returned 4 [0263.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString=".jpg") returned 4 [0263.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.424] lstrlenW (lpString=".doc") returned 4 [0263.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString=".docx") returned 5 [0263.424] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0263.424] lstrlenW (lpString=".pdf") returned 4 [0263.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString=".xls") returned 4 [0263.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString=".xlsx") returned 5 [0263.424] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0263.424] lstrlenW (lpString=".ppt") returned 4 [0263.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.424] lstrlenW (lpString=".zip") returned 4 [0263.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.424] lstrlenW (lpString=".rar") returned 4 [0263.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString=".bz2") returned 4 [0263.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString=".7z") returned 3 [0263.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.424] lstrlenW (lpString=".dbf") returned 4 [0263.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.424] lstrlenW (lpString=".1cd") returned 4 [0263.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0263.424] lstrlenW (lpString=".jpg") returned 4 [0263.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.424] lstrcmpiW (lpString1=".chm", lpString2=".drweb") returned -1 [0263.424] lstrlenW (lpString="setup.chm") returned 9 [0263.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.425] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=67190) returned 1 [0263.425] CloseHandle (hObject=0x1a8) returned 1 [0263.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0263.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.425] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.425] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0263.426] GetLastError () returned 0x0 [0263.426] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x10676, lpOverlapped=0x0) returned 1 [0263.689] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0263.692] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.692] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.692] SetEndOfFile (hFile=0x1ac) returned 1 [0263.692] CloseHandle (hObject=0x1ac) returned 1 [0263.694] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.694] SetEndOfFile (hFile=0x1a8) returned 1 [0263.696] CloseHandle (hObject=0x1a8) returned 1 [0263.696] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.696] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0263.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.696] lstrlenW (lpString=".doc") returned 4 [0263.696] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0263.696] lstrlenW (lpString=".docx") returned 5 [0263.696] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0263.696] lstrlenW (lpString=".pdf") returned 4 [0263.697] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString=".xls") returned 4 [0263.697] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString=".xlsx") returned 5 [0263.697] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0263.697] lstrlenW (lpString=".ppt") returned 4 [0263.697] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.697] lstrlenW (lpString=".zip") returned 4 [0263.697] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString=".rar") returned 4 [0263.697] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString=".bz2") returned 4 [0263.697] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0263.697] lstrlenW (lpString=".7z") returned 3 [0263.697] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0263.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.697] lstrlenW (lpString=".dbf") returned 4 [0263.697] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.697] lstrlenW (lpString=".1cd") returned 4 [0263.697] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0263.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.697] lstrlenW (lpString=".jpg") returned 4 [0263.697] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0263.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.697] lstrlenW (lpString=".doc") returned 4 [0263.698] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString=".docx") returned 5 [0263.698] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0263.698] lstrlenW (lpString=".pdf") returned 4 [0263.698] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString=".xls") returned 4 [0263.698] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString=".xlsx") returned 5 [0263.698] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0263.698] lstrlenW (lpString=".ppt") returned 4 [0263.698] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.698] lstrlenW (lpString=".zip") returned 4 [0263.698] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString=".rar") returned 4 [0263.698] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString=".bz2") returned 4 [0263.698] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0263.698] lstrlenW (lpString=".7z") returned 3 [0263.698] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0263.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.698] lstrlenW (lpString=".dbf") returned 4 [0263.698] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0263.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.698] lstrlenW (lpString=".1cd") returned 4 [0263.698] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0263.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0263.698] lstrlenW (lpString=".jpg") returned 4 [0263.699] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0263.699] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.699] lstrlenW (lpString="Setup.xml") returned 9 [0263.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.699] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2624) returned 1 [0263.699] CloseHandle (hObject=0x1a8) returned 1 [0263.699] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0263.699] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.700] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.700] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0263.701] GetLastError () returned 0x0 [0263.701] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xa40, lpOverlapped=0x0) returned 1 [0263.967] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0263.967] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.967] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0263.968] SetEndOfFile (hFile=0x1ac) returned 1 [0263.968] CloseHandle (hObject=0x1ac) returned 1 [0263.969] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.969] SetEndOfFile (hFile=0x1a8) returned 1 [0263.970] CloseHandle (hObject=0x1a8) returned 1 [0263.970] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.970] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0263.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.970] lstrlenW (lpString=".doc") returned 4 [0263.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.970] lstrlenW (lpString=".docx") returned 5 [0263.970] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.970] lstrlenW (lpString=".pdf") returned 4 [0263.970] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.971] lstrlenW (lpString=".xls") returned 4 [0263.971] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.971] lstrlenW (lpString=".xlsx") returned 5 [0263.971] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.971] lstrlenW (lpString=".ppt") returned 4 [0263.971] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.971] lstrlenW (lpString=".zip") returned 4 [0263.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.971] lstrlenW (lpString=".rar") returned 4 [0263.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.971] lstrlenW (lpString=".bz2") returned 4 [0263.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.971] lstrlenW (lpString=".7z") returned 3 [0263.971] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.972] lstrlenW (lpString=".dbf") returned 4 [0263.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.972] lstrlenW (lpString=".1cd") returned 4 [0263.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.972] lstrlenW (lpString=".jpg") returned 4 [0263.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.972] lstrlenW (lpString=".doc") returned 4 [0263.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString=".docx") returned 5 [0263.972] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0263.972] lstrlenW (lpString=".pdf") returned 4 [0263.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString=".xls") returned 4 [0263.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString=".xlsx") returned 5 [0263.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0263.972] lstrlenW (lpString=".ppt") returned 4 [0263.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0263.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.972] lstrlenW (lpString=".zip") returned 4 [0263.972] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0263.972] lstrlenW (lpString=".rar") returned 4 [0263.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0263.973] lstrlenW (lpString=".bz2") returned 4 [0263.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0263.973] lstrlenW (lpString=".7z") returned 3 [0263.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0263.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.973] lstrlenW (lpString=".dbf") returned 4 [0263.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0263.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.973] lstrlenW (lpString=".1cd") returned 4 [0263.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0263.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0263.973] lstrlenW (lpString=".jpg") returned 4 [0263.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0263.973] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0263.973] lstrlenW (lpString="Office32WW.xml") returned 14 [0263.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.974] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=4274) returned 1 [0263.974] CloseHandle (hObject=0x1a8) returned 1 [0263.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0263.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0263.975] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.975] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0263.975] GetLastError () returned 0x0 [0263.975] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0263.993] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0263.994] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.994] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0263.994] SetEndOfFile (hFile=0x1ac) returned 1 [0263.994] CloseHandle (hObject=0x1ac) returned 1 [0263.996] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.996] SetEndOfFile (hFile=0x1a8) returned 1 [0263.997] CloseHandle (hObject=0x1a8) returned 1 [0264.015] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.015] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0264.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.015] lstrlenW (lpString=".doc") returned 4 [0264.015] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString=".docx") returned 5 [0264.016] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.016] lstrlenW (lpString=".pdf") returned 4 [0264.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString=".xls") returned 4 [0264.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString=".xlsx") returned 5 [0264.016] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.016] lstrlenW (lpString=".ppt") returned 4 [0264.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.016] lstrlenW (lpString=".zip") returned 4 [0264.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.016] lstrlenW (lpString=".rar") returned 4 [0264.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString=".bz2") returned 4 [0264.016] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString=".7z") returned 3 [0264.016] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.016] lstrlenW (lpString=".dbf") returned 4 [0264.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.016] lstrlenW (lpString=".1cd") returned 4 [0264.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.017] lstrlenW (lpString=".jpg") returned 4 [0264.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.017] lstrlenW (lpString=".doc") returned 4 [0264.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.017] lstrlenW (lpString=".docx") returned 5 [0264.017] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0264.017] lstrlenW (lpString=".pdf") returned 4 [0264.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.017] lstrlenW (lpString=".xls") returned 4 [0264.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.017] lstrlenW (lpString=".xlsx") returned 5 [0264.017] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0264.018] lstrlenW (lpString=".ppt") returned 4 [0264.018] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.018] lstrlenW (lpString=".zip") returned 4 [0264.018] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.018] lstrlenW (lpString=".rar") returned 4 [0264.018] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.018] lstrlenW (lpString=".bz2") returned 4 [0264.018] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.018] lstrlenW (lpString=".7z") returned 3 [0264.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.018] lstrlenW (lpString=".dbf") returned 4 [0264.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.018] lstrlenW (lpString=".1cd") returned 4 [0264.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0264.018] lstrlenW (lpString=".jpg") returned 4 [0264.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.018] lstrcmpiW (lpString1=".xml", lpString2=".drweb") returned 1 [0264.018] lstrlenW (lpString="Setup.xml") returned 9 [0264.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0264.019] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=16683) returned 1 [0264.019] CloseHandle (hObject=0x1a8) returned 1 [0264.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0264.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0264.019] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.019] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0264.019] GetLastError () returned 0x0 [0264.020] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x412b, lpOverlapped=0x0) returned 1 [0264.168] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0264.169] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.169] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0264.169] SetEndOfFile (hFile=0x1ac) returned 1 [0264.170] CloseHandle (hObject=0x1ac) returned 1 [0264.171] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.171] SetEndOfFile (hFile=0x1a8) returned 1 [0264.172] CloseHandle (hObject=0x1a8) returned 1 [0264.172] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0264.172] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0264.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.173] lstrlenW (lpString=".doc") returned 4 [0264.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString=".docx") returned 5 [0264.173] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0264.173] lstrlenW (lpString=".pdf") returned 4 [0264.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString=".xls") returned 4 [0264.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString=".xlsx") returned 5 [0264.173] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0264.173] lstrlenW (lpString=".ppt") returned 4 [0264.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.173] lstrlenW (lpString=".zip") returned 4 [0264.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.173] lstrlenW (lpString=".rar") returned 4 [0264.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString=".bz2") returned 4 [0264.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString=".7z") returned 3 [0264.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.173] lstrlenW (lpString=".dbf") returned 4 [0264.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.173] lstrlenW (lpString=".1cd") returned 4 [0264.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.174] lstrlenW (lpString=".jpg") returned 4 [0264.174] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.174] lstrlenW (lpString=".doc") returned 4 [0264.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString=".docx") returned 5 [0264.174] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0264.174] lstrlenW (lpString=".pdf") returned 4 [0264.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString=".xls") returned 4 [0264.174] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString=".xlsx") returned 5 [0264.174] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0264.174] lstrlenW (lpString=".ppt") returned 4 [0264.174] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.174] lstrlenW (lpString=".zip") returned 4 [0264.174] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0264.174] lstrlenW (lpString=".rar") returned 4 [0264.174] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString=".bz2") returned 4 [0264.174] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0264.174] lstrlenW (lpString=".7z") returned 3 [0264.174] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0264.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.174] lstrlenW (lpString=".dbf") returned 4 [0264.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0264.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.175] lstrlenW (lpString=".1cd") returned 4 [0264.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0264.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0264.175] lstrlenW (lpString=".jpg") returned 4 [0264.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0264.175] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0264.175] lstrlenW (lpString="MS.GIF") returned 6 [0264.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.212] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1069) returned 1 [0264.212] CloseHandle (hObject=0x1c0) returned 1 [0264.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0264.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.213] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.213] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0264.213] GetLastError () returned 0x0 [0264.222] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x42d, lpOverlapped=0x0) returned 1 [0264.239] WriteFile (in: hFile=0x1c4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x430, lpOverlapped=0x0) returned 1 [0264.241] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.241] WriteFile (in: hFile=0x1c4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0264.241] SetEndOfFile (hFile=0x1c4) returned 1 [0264.241] CloseHandle (hObject=0x1c4) returned 1 [0264.243] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.243] SetEndOfFile (hFile=0x1c0) returned 1 [0264.244] CloseHandle (hObject=0x1c0) returned 1 [0264.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0264.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0264.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.245] lstrlenW (lpString=".doc") returned 4 [0264.245] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.245] lstrlenW (lpString=".docx") returned 5 [0264.245] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0264.245] lstrlenW (lpString=".pdf") returned 4 [0264.245] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.245] lstrlenW (lpString=".xls") returned 4 [0264.245] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.245] lstrlenW (lpString=".xlsx") returned 5 [0264.245] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0264.245] lstrlenW (lpString=".ppt") returned 4 [0264.245] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.245] lstrlenW (lpString=".zip") returned 4 [0264.245] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.245] lstrlenW (lpString=".rar") returned 4 [0264.245] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.245] lstrlenW (lpString=".bz2") returned 4 [0264.245] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.245] lstrlenW (lpString=".7z") returned 3 [0264.245] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.245] lstrlenW (lpString=".dbf") returned 4 [0264.245] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.246] lstrlenW (lpString=".1cd") returned 4 [0264.246] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.246] lstrlenW (lpString=".jpg") returned 4 [0264.246] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.246] lstrlenW (lpString=".doc") returned 4 [0264.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.246] lstrlenW (lpString=".docx") returned 5 [0264.246] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0264.246] lstrlenW (lpString=".pdf") returned 4 [0264.246] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.246] lstrlenW (lpString=".xls") returned 4 [0264.246] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.246] lstrlenW (lpString=".xlsx") returned 5 [0264.246] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0264.246] lstrlenW (lpString=".ppt") returned 4 [0264.246] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.246] lstrlenW (lpString=".zip") returned 4 [0264.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.246] lstrlenW (lpString=".rar") returned 4 [0264.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.247] lstrlenW (lpString=".bz2") returned 4 [0264.247] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.247] lstrlenW (lpString=".7z") returned 3 [0264.247] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.247] lstrlenW (lpString=".dbf") returned 4 [0264.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.247] lstrlenW (lpString=".1cd") returned 4 [0264.247] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0264.247] lstrlenW (lpString=".jpg") returned 4 [0264.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.247] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.247] lstrlenW (lpString="boxed-delete.avi") returned 16 [0264.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.262] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=31744) returned 1 [0264.262] CloseHandle (hObject=0x1c0) returned 1 [0264.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0264.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.263] lstrlenW (lpString=".doc") returned 4 [0264.263] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString=".docx") returned 5 [0264.263] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0264.263] lstrlenW (lpString=".pdf") returned 4 [0264.263] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString=".xls") returned 4 [0264.263] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString=".xlsx") returned 5 [0264.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0264.263] lstrlenW (lpString=".ppt") returned 4 [0264.263] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.263] lstrlenW (lpString=".zip") returned 4 [0264.263] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString=".rar") returned 4 [0264.263] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString=".bz2") returned 4 [0264.263] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.263] lstrlenW (lpString=".7z") returned 3 [0264.263] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.264] lstrlenW (lpString=".dbf") returned 4 [0264.264] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.264] lstrlenW (lpString=".1cd") returned 4 [0264.264] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.264] lstrlenW (lpString=".jpg") returned 4 [0264.264] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.264] lstrlenW (lpString=".doc") returned 4 [0264.264] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.264] lstrlenW (lpString=".docx") returned 5 [0264.264] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0264.264] lstrlenW (lpString=".pdf") returned 4 [0264.264] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.264] lstrlenW (lpString=".xls") returned 4 [0264.264] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.264] lstrlenW (lpString=".xlsx") returned 5 [0264.264] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0264.264] lstrlenW (lpString=".ppt") returned 4 [0264.264] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.264] lstrlenW (lpString=".zip") returned 4 [0264.265] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.265] lstrlenW (lpString=".rar") returned 4 [0264.265] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.265] lstrlenW (lpString=".bz2") returned 4 [0264.265] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.265] lstrlenW (lpString=".7z") returned 3 [0264.265] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.265] lstrlenW (lpString=".dbf") returned 4 [0264.265] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.265] lstrlenW (lpString=".1cd") returned 4 [0264.265] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0264.265] lstrlenW (lpString=".jpg") returned 4 [0264.265] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.265] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.265] lstrlenW (lpString="correct.avi") returned 11 [0264.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.266] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=197120) returned 1 [0264.266] CloseHandle (hObject=0x1c0) returned 1 [0264.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0264.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.266] lstrlenW (lpString=".doc") returned 4 [0264.266] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.266] lstrlenW (lpString=".docx") returned 5 [0264.266] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.266] lstrlenW (lpString=".pdf") returned 4 [0264.266] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.266] lstrlenW (lpString=".xls") returned 4 [0264.266] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.266] lstrlenW (lpString=".xlsx") returned 5 [0264.266] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.266] lstrlenW (lpString=".ppt") returned 4 [0264.266] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.267] lstrlenW (lpString=".zip") returned 4 [0264.267] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString=".rar") returned 4 [0264.267] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString=".bz2") returned 4 [0264.267] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString=".7z") returned 3 [0264.267] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.267] lstrlenW (lpString=".dbf") returned 4 [0264.267] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.267] lstrlenW (lpString=".1cd") returned 4 [0264.267] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.267] lstrlenW (lpString=".jpg") returned 4 [0264.267] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.267] lstrlenW (lpString=".doc") returned 4 [0264.267] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.267] lstrlenW (lpString=".docx") returned 5 [0264.267] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.267] lstrlenW (lpString=".pdf") returned 4 [0264.267] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString=".xls") returned 4 [0264.268] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString=".xlsx") returned 5 [0264.268] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.268] lstrlenW (lpString=".ppt") returned 4 [0264.268] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.268] lstrlenW (lpString=".zip") returned 4 [0264.268] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString=".rar") returned 4 [0264.268] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString=".bz2") returned 4 [0264.268] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString=".7z") returned 3 [0264.268] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.268] lstrlenW (lpString=".dbf") returned 4 [0264.268] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.268] lstrlenW (lpString=".1cd") returned 4 [0264.268] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0264.268] lstrlenW (lpString=".jpg") returned 4 [0264.268] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.269] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.269] lstrlenW (lpString="delete.avi") returned 10 [0264.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.270] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=224256) returned 1 [0264.270] CloseHandle (hObject=0x1c0) returned 1 [0264.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0264.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.270] lstrlenW (lpString=".doc") returned 4 [0264.270] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.270] lstrlenW (lpString=".docx") returned 5 [0264.270] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0264.270] lstrlenW (lpString=".pdf") returned 4 [0264.270] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.270] lstrlenW (lpString=".xls") returned 4 [0264.270] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.270] lstrlenW (lpString=".xlsx") returned 5 [0264.270] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0264.270] lstrlenW (lpString=".ppt") returned 4 [0264.270] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.270] lstrlenW (lpString=".zip") returned 4 [0264.271] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString=".rar") returned 4 [0264.271] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString=".bz2") returned 4 [0264.271] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString=".7z") returned 3 [0264.271] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.271] lstrlenW (lpString=".dbf") returned 4 [0264.271] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.271] lstrlenW (lpString=".1cd") returned 4 [0264.271] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.271] lstrlenW (lpString=".jpg") returned 4 [0264.271] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.271] lstrlenW (lpString=".doc") returned 4 [0264.271] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString=".docx") returned 5 [0264.271] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0264.271] lstrlenW (lpString=".pdf") returned 4 [0264.271] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.271] lstrlenW (lpString=".xls") returned 4 [0264.271] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.272] lstrlenW (lpString=".xlsx") returned 5 [0264.272] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0264.272] lstrlenW (lpString=".ppt") returned 4 [0264.272] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.272] lstrlenW (lpString=".zip") returned 4 [0264.272] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.272] lstrlenW (lpString=".rar") returned 4 [0264.272] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.272] lstrlenW (lpString=".bz2") returned 4 [0264.272] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.272] lstrlenW (lpString=".7z") returned 3 [0264.272] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.272] lstrlenW (lpString=".dbf") returned 4 [0264.272] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.272] lstrlenW (lpString=".1cd") returned 4 [0264.272] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0264.272] lstrlenW (lpString=".jpg") returned 4 [0264.272] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.273] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.273] lstrlenW (lpString="join.avi") returned 8 [0264.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.273] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=222208) returned 1 [0264.273] CloseHandle (hObject=0x1c0) returned 1 [0264.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0264.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.273] lstrlenW (lpString=".doc") returned 4 [0264.273] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString=".docx") returned 5 [0264.274] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0264.274] lstrlenW (lpString=".pdf") returned 4 [0264.274] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString=".xls") returned 4 [0264.274] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString=".xlsx") returned 5 [0264.274] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0264.274] lstrlenW (lpString=".ppt") returned 4 [0264.274] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.274] lstrlenW (lpString=".zip") returned 4 [0264.274] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString=".rar") returned 4 [0264.274] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString=".bz2") returned 4 [0264.274] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString=".7z") returned 3 [0264.274] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.274] lstrlenW (lpString=".dbf") returned 4 [0264.274] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.274] lstrlenW (lpString=".1cd") returned 4 [0264.274] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.274] lstrlenW (lpString=".jpg") returned 4 [0264.275] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.275] lstrlenW (lpString=".doc") returned 4 [0264.275] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString=".docx") returned 5 [0264.275] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0264.275] lstrlenW (lpString=".pdf") returned 4 [0264.275] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString=".xls") returned 4 [0264.275] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString=".xlsx") returned 5 [0264.275] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0264.275] lstrlenW (lpString=".ppt") returned 4 [0264.275] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.275] lstrlenW (lpString=".zip") returned 4 [0264.275] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString=".rar") returned 4 [0264.275] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString=".bz2") returned 4 [0264.275] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.275] lstrlenW (lpString=".7z") returned 3 [0264.275] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.276] lstrlenW (lpString=".dbf") returned 4 [0264.276] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.276] lstrlenW (lpString=".1cd") returned 4 [0264.276] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0264.276] lstrlenW (lpString=".jpg") returned 4 [0264.276] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.276] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.276] lstrlenW (lpString="split.avi") returned 9 [0264.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0264.276] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=194048) returned 1 [0264.277] CloseHandle (hObject=0x1c0) returned 1 [0264.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0264.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0264.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.277] lstrlenW (lpString=".doc") returned 4 [0264.277] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.277] lstrlenW (lpString=".docx") returned 5 [0264.277] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.277] lstrlenW (lpString=".pdf") returned 4 [0264.277] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.277] lstrlenW (lpString=".xls") returned 4 [0264.277] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.277] lstrlenW (lpString=".xlsx") returned 5 [0264.277] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.277] lstrlenW (lpString=".ppt") returned 4 [0264.277] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.278] lstrlenW (lpString=".zip") returned 4 [0264.278] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString=".rar") returned 4 [0264.278] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString=".bz2") returned 4 [0264.278] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString=".7z") returned 3 [0264.278] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.278] lstrlenW (lpString=".dbf") returned 4 [0264.278] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.278] lstrlenW (lpString=".1cd") returned 4 [0264.278] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.278] lstrlenW (lpString=".jpg") returned 4 [0264.278] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.278] lstrlenW (lpString=".doc") returned 4 [0264.278] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString=".docx") returned 5 [0264.278] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0264.278] lstrlenW (lpString=".pdf") returned 4 [0264.278] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.278] lstrlenW (lpString=".xls") returned 4 [0264.279] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.279] lstrlenW (lpString=".xlsx") returned 5 [0264.279] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0264.279] lstrlenW (lpString=".ppt") returned 4 [0264.279] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.279] lstrlenW (lpString=".zip") returned 4 [0264.279] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.279] lstrlenW (lpString=".rar") returned 4 [0264.279] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.279] lstrlenW (lpString=".bz2") returned 4 [0264.279] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.279] lstrlenW (lpString=".7z") returned 3 [0264.279] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.279] lstrlenW (lpString=".dbf") returned 4 [0264.279] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0264.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.279] lstrlenW (lpString=".1cd") returned 4 [0264.279] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0264.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0264.279] lstrlenW (lpString=".jpg") returned 4 [0264.279] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0264.280] Sleep (dwMilliseconds=0x64) [0264.739] lstrcmpiW (lpString1=".avi", lpString2=".drweb") returned -1 [0264.739] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0264.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0264.740] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1600388) returned 1 [0264.740] CloseHandle (hObject=0x1c4) returned 1 [0264.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0264.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0264.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0264.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0264.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0264.740] lstrlenW (lpString=".doc") returned 4 [0264.740] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString=".docx") returned 5 [0264.741] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0264.741] lstrlenW (lpString=".pdf") returned 4 [0264.741] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString=".xls") returned 4 [0264.741] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString=".xlsx") returned 5 [0264.741] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0264.741] lstrlenW (lpString=".ppt") returned 4 [0264.741] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0264.741] lstrlenW (lpString=".zip") returned 4 [0264.741] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString=".rar") returned 4 [0264.741] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString=".bz2") returned 4 [0264.741] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0264.741] lstrlenW (lpString=".7z") returned 3 [0264.741] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0264.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0264.741] lstrlenW (lpString=".dbf") returned 4 [0264.741] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0265.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0265.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0265.539] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fc6c | out: lpNewFilePointer=0x0) returned 1 [0265.539] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fc2c | out: lpNewFilePointer=0x0) returned 1 [0265.539] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x318fc38*=0x40000, lpOverlapped=0x0) returned 1 [0265.574] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x318fc2c | out: lpNewFilePointer=0x0) returned 1 [0265.574] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x318fc38*=0x40000, lpOverlapped=0x0) returned 1 [0266.538] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x318fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0266.538] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x318fc2c | out: lpNewFilePointer=0x0) returned 1 [0266.538] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x318fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x318fc38*=0x40000, lpOverlapped=0x0) returned 1 [0267.035] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.035] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x318fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0267.196] SetEndOfFile (hFile=0x1b0) returned 1 [0267.196] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fa48d0 [0267.201] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.201] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fa48d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa48d0*, lpNumberOfBytesWritten=0x318fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.203] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x318fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.203] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fa48d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa48d0*, lpNumberOfBytesWritten=0x318fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.205] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x318fc7c | out: lpNewFilePointer=0x0) returned 1 [0267.206] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fa48d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x318fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa48d0*, lpNumberOfBytesWritten=0x318fc88*=0x40000, lpOverlapped=0x0) returned 1 [0267.208] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fa48d0 | out: hHeap=0x2e0000) returned 1 [0267.208] CloseHandle (hObject=0x1b0) returned 1 [0267.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0267.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.919] lstrlenW (lpString=".doc") returned 4 [0267.919] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.919] lstrlenW (lpString=".docx") returned 5 [0267.920] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0267.920] lstrlenW (lpString=".pdf") returned 4 [0267.920] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.920] lstrlenW (lpString=".xls") returned 4 [0267.920] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.920] lstrlenW (lpString=".xlsx") returned 5 [0267.920] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0267.920] lstrlenW (lpString=".ppt") returned 4 [0267.920] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.920] lstrlenW (lpString=".zip") returned 4 [0267.920] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.920] lstrlenW (lpString=".rar") returned 4 [0267.920] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.920] lstrlenW (lpString=".bz2") returned 4 [0267.920] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.920] lstrlenW (lpString=".7z") returned 3 [0267.920] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.920] lstrlenW (lpString=".dbf") returned 4 [0267.920] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.920] lstrlenW (lpString=".1cd") returned 4 [0267.920] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.920] lstrlenW (lpString=".jpg") returned 4 [0267.920] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.921] lstrlenW (lpString=".doc") returned 4 [0267.921] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString=".docx") returned 5 [0267.921] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0267.921] lstrlenW (lpString=".pdf") returned 4 [0267.921] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString=".xls") returned 4 [0267.921] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString=".xlsx") returned 5 [0267.921] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0267.921] lstrlenW (lpString=".ppt") returned 4 [0267.921] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.921] lstrlenW (lpString=".zip") returned 4 [0267.921] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString=".rar") returned 4 [0267.921] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString=".bz2") returned 4 [0267.921] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0267.921] lstrlenW (lpString=".7z") returned 3 [0267.921] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0267.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.921] lstrlenW (lpString=".dbf") returned 4 [0267.921] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0267.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.921] lstrlenW (lpString=".1cd") returned 4 [0267.921] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0267.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0267.921] lstrlenW (lpString=".jpg") returned 4 [0267.922] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0267.922] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0267.922] lstrlenW (lpString="SETUP.XML") returned 9 [0267.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.422] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=4207) returned 1 [0268.422] CloseHandle (hObject=0x1e0) returned 1 [0268.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0268.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0268.422] GetLastError () returned 0x0 [0268.422] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x106f, lpOverlapped=0x0) returned 1 [0268.467] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0268.468] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.468] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.469] SetEndOfFile (hFile=0x1e8) returned 1 [0268.469] CloseHandle (hObject=0x1e8) returned 1 [0268.470] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.470] SetEndOfFile (hFile=0x1e0) returned 1 [0268.471] CloseHandle (hObject=0x1e0) returned 1 [0268.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0268.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.472] lstrlenW (lpString=".doc") returned 4 [0268.472] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.472] lstrlenW (lpString=".docx") returned 5 [0268.472] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.472] lstrlenW (lpString=".pdf") returned 4 [0268.472] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.472] lstrlenW (lpString=".xls") returned 4 [0268.472] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.472] lstrlenW (lpString=".xlsx") returned 5 [0268.472] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.472] lstrlenW (lpString=".ppt") returned 4 [0268.472] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.472] lstrlenW (lpString=".zip") returned 4 [0268.472] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.472] lstrlenW (lpString=".rar") returned 4 [0268.472] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.472] lstrlenW (lpString=".bz2") returned 4 [0268.472] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.472] lstrlenW (lpString=".7z") returned 3 [0268.472] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.472] lstrlenW (lpString=".dbf") returned 4 [0268.472] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.473] lstrlenW (lpString=".1cd") returned 4 [0268.473] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.473] lstrlenW (lpString=".jpg") returned 4 [0268.473] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.473] lstrlenW (lpString=".doc") returned 4 [0268.473] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString=".docx") returned 5 [0268.473] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.473] lstrlenW (lpString=".pdf") returned 4 [0268.473] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString=".xls") returned 4 [0268.473] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString=".xlsx") returned 5 [0268.473] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.473] lstrlenW (lpString=".ppt") returned 4 [0268.473] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.473] lstrlenW (lpString=".zip") returned 4 [0268.473] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.473] lstrlenW (lpString=".rar") returned 4 [0268.473] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.473] lstrlenW (lpString=".bz2") returned 4 [0268.474] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.474] lstrlenW (lpString=".7z") returned 3 [0268.474] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.474] lstrlenW (lpString=".dbf") returned 4 [0268.474] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.474] lstrlenW (lpString=".1cd") returned 4 [0268.474] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0268.474] lstrlenW (lpString=".jpg") returned 4 [0268.474] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.474] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.474] lstrlenW (lpString="SETUP.XML") returned 9 [0268.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.475] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1872) returned 1 [0268.475] CloseHandle (hObject=0x1e0) returned 1 [0268.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0268.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.475] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.475] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0268.476] GetLastError () returned 0x0 [0268.476] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x750, lpOverlapped=0x0) returned 1 [0268.507] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x760, lpOverlapped=0x0) returned 1 [0268.508] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.508] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.508] SetEndOfFile (hFile=0x1e8) returned 1 [0268.508] CloseHandle (hObject=0x1e8) returned 1 [0268.510] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.510] SetEndOfFile (hFile=0x1e0) returned 1 [0268.511] CloseHandle (hObject=0x1e0) returned 1 [0268.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0268.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.512] lstrlenW (lpString=".doc") returned 4 [0268.512] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.512] lstrlenW (lpString=".docx") returned 5 [0268.512] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.512] lstrlenW (lpString=".pdf") returned 4 [0268.512] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.512] lstrlenW (lpString=".xls") returned 4 [0268.512] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.512] lstrlenW (lpString=".xlsx") returned 5 [0268.512] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.513] lstrlenW (lpString=".ppt") returned 4 [0268.513] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.513] lstrlenW (lpString=".zip") returned 4 [0268.513] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.513] lstrlenW (lpString=".rar") returned 4 [0268.513] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.513] lstrlenW (lpString=".bz2") returned 4 [0268.513] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.513] lstrlenW (lpString=".7z") returned 3 [0268.513] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.513] lstrlenW (lpString=".dbf") returned 4 [0268.513] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.513] lstrlenW (lpString=".1cd") returned 4 [0268.513] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.513] lstrlenW (lpString=".jpg") returned 4 [0268.513] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.513] lstrlenW (lpString=".doc") returned 4 [0268.514] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString=".docx") returned 5 [0268.514] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.514] lstrlenW (lpString=".pdf") returned 4 [0268.514] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString=".xls") returned 4 [0268.514] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString=".xlsx") returned 5 [0268.514] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.514] lstrlenW (lpString=".ppt") returned 4 [0268.514] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.514] lstrlenW (lpString=".zip") returned 4 [0268.514] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.514] lstrlenW (lpString=".rar") returned 4 [0268.514] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString=".bz2") returned 4 [0268.514] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString=".7z") returned 3 [0268.514] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.514] lstrlenW (lpString=".dbf") returned 4 [0268.514] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.515] lstrlenW (lpString=".1cd") returned 4 [0268.515] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0268.515] lstrlenW (lpString=".jpg") returned 4 [0268.515] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.515] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.515] lstrlenW (lpString="Proof.XML") returned 9 [0268.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.518] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1347) returned 1 [0268.518] CloseHandle (hObject=0x1e0) returned 1 [0268.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0268.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.518] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.518] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0268.519] GetLastError () returned 0x0 [0268.519] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x543, lpOverlapped=0x0) returned 1 [0268.602] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x550, lpOverlapped=0x0) returned 1 [0268.603] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.603] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.604] SetEndOfFile (hFile=0x1e8) returned 1 [0268.604] CloseHandle (hObject=0x1e8) returned 1 [0268.605] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.605] SetEndOfFile (hFile=0x1e0) returned 1 [0268.606] CloseHandle (hObject=0x1e0) returned 1 [0268.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.607] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0268.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.607] lstrlenW (lpString=".doc") returned 4 [0268.607] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.607] lstrlenW (lpString=".docx") returned 5 [0268.607] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0268.608] lstrlenW (lpString=".pdf") returned 4 [0268.608] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.608] lstrlenW (lpString=".xls") returned 4 [0268.608] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.608] lstrlenW (lpString=".xlsx") returned 5 [0268.608] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0268.608] lstrlenW (lpString=".ppt") returned 4 [0268.608] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.608] lstrlenW (lpString=".zip") returned 4 [0268.608] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.608] lstrlenW (lpString=".rar") returned 4 [0268.608] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.608] lstrlenW (lpString=".bz2") returned 4 [0268.608] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.608] lstrlenW (lpString=".7z") returned 3 [0268.608] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.608] lstrlenW (lpString=".dbf") returned 4 [0268.608] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.608] lstrlenW (lpString=".1cd") returned 4 [0268.609] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.609] lstrlenW (lpString=".jpg") returned 4 [0268.609] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.609] lstrlenW (lpString=".doc") returned 4 [0268.609] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.609] lstrlenW (lpString=".docx") returned 5 [0268.609] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0268.609] lstrlenW (lpString=".pdf") returned 4 [0268.609] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.609] lstrlenW (lpString=".xls") returned 4 [0268.609] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.609] lstrlenW (lpString=".xlsx") returned 5 [0268.609] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0268.609] lstrlenW (lpString=".ppt") returned 4 [0268.609] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.609] lstrlenW (lpString=".zip") returned 4 [0268.609] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.610] lstrlenW (lpString=".rar") returned 4 [0268.610] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.610] lstrlenW (lpString=".bz2") returned 4 [0268.610] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.610] lstrlenW (lpString=".7z") returned 3 [0268.610] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.610] lstrlenW (lpString=".dbf") returned 4 [0268.610] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.610] lstrlenW (lpString=".1cd") returned 4 [0268.610] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0268.610] lstrlenW (lpString=".jpg") returned 4 [0268.610] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.610] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.610] lstrlenW (lpString="Proofing.XML") returned 12 [0268.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.612] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=811) returned 1 [0268.612] CloseHandle (hObject=0x1e0) returned 1 [0268.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0268.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.612] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.612] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0268.613] GetLastError () returned 0x0 [0268.613] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x32b, lpOverlapped=0x0) returned 1 [0268.623] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x330, lpOverlapped=0x0) returned 1 [0268.624] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.624] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.624] SetEndOfFile (hFile=0x1e8) returned 1 [0268.624] CloseHandle (hObject=0x1e8) returned 1 [0268.628] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.628] SetEndOfFile (hFile=0x1e0) returned 1 [0268.629] CloseHandle (hObject=0x1e0) returned 1 [0268.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.630] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0268.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.630] lstrlenW (lpString=".doc") returned 4 [0268.630] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.630] lstrlenW (lpString=".docx") returned 5 [0268.630] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0268.630] lstrlenW (lpString=".pdf") returned 4 [0268.631] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.631] lstrlenW (lpString=".xls") returned 4 [0268.631] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.631] lstrlenW (lpString=".xlsx") returned 5 [0268.631] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0268.631] lstrlenW (lpString=".ppt") returned 4 [0268.631] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.631] lstrlenW (lpString=".zip") returned 4 [0268.631] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.631] lstrlenW (lpString=".rar") returned 4 [0268.631] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.631] lstrlenW (lpString=".bz2") returned 4 [0268.631] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.631] lstrlenW (lpString=".7z") returned 3 [0268.631] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.631] lstrlenW (lpString=".dbf") returned 4 [0268.631] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.631] lstrlenW (lpString=".1cd") returned 4 [0268.631] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.632] lstrlenW (lpString=".jpg") returned 4 [0268.632] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.632] lstrlenW (lpString=".doc") returned 4 [0268.632] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.632] lstrlenW (lpString=".docx") returned 5 [0268.632] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0268.632] lstrlenW (lpString=".pdf") returned 4 [0268.632] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.632] lstrlenW (lpString=".xls") returned 4 [0268.632] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.632] lstrlenW (lpString=".xlsx") returned 5 [0268.632] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0268.632] lstrlenW (lpString=".ppt") returned 4 [0268.632] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.632] lstrlenW (lpString=".zip") returned 4 [0268.632] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.632] lstrlenW (lpString=".rar") returned 4 [0268.633] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.633] lstrlenW (lpString=".bz2") returned 4 [0268.633] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.633] lstrlenW (lpString=".7z") returned 3 [0268.633] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.633] lstrlenW (lpString=".dbf") returned 4 [0268.633] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.633] lstrlenW (lpString=".1cd") returned 4 [0268.633] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0268.633] lstrlenW (lpString=".jpg") returned 4 [0268.633] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.633] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.633] lstrlenW (lpString="SETUP.XML") returned 9 [0268.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.634] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=5884) returned 1 [0268.634] CloseHandle (hObject=0x1e0) returned 1 [0268.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0268.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0268.635] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.635] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0268.638] GetLastError () returned 0x0 [0268.638] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0268.655] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0268.656] ReadFile (in: hFile=0x1e0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.656] WriteFile (in: hFile=0x1e8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.656] SetEndOfFile (hFile=0x1e8) returned 1 [0268.656] CloseHandle (hObject=0x1e8) returned 1 [0268.659] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.659] SetEndOfFile (hFile=0x1e0) returned 1 [0268.660] CloseHandle (hObject=0x1e0) returned 1 [0268.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0268.661] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0268.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.661] lstrlenW (lpString=".doc") returned 4 [0268.661] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.661] lstrlenW (lpString=".docx") returned 5 [0268.661] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.661] lstrlenW (lpString=".pdf") returned 4 [0268.661] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.661] lstrlenW (lpString=".xls") returned 4 [0268.661] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.661] lstrlenW (lpString=".xlsx") returned 5 [0268.661] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.661] lstrlenW (lpString=".ppt") returned 4 [0268.661] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.662] lstrlenW (lpString=".zip") returned 4 [0268.662] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.662] lstrlenW (lpString=".rar") returned 4 [0268.662] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.662] lstrlenW (lpString=".bz2") returned 4 [0268.662] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.662] lstrlenW (lpString=".7z") returned 3 [0268.662] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.662] lstrlenW (lpString=".dbf") returned 4 [0268.662] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.662] lstrlenW (lpString=".1cd") returned 4 [0268.662] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.662] lstrlenW (lpString=".jpg") returned 4 [0268.662] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.662] lstrlenW (lpString=".doc") returned 4 [0268.662] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0268.662] lstrlenW (lpString=".docx") returned 5 [0268.662] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0268.662] lstrlenW (lpString=".pdf") returned 4 [0268.663] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString=".xls") returned 4 [0268.663] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString=".xlsx") returned 5 [0268.663] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0268.663] lstrlenW (lpString=".ppt") returned 4 [0268.663] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.663] lstrlenW (lpString=".zip") returned 4 [0268.663] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0268.663] lstrlenW (lpString=".rar") returned 4 [0268.663] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString=".bz2") returned 4 [0268.663] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString=".7z") returned 3 [0268.663] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0268.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.663] lstrlenW (lpString=".dbf") returned 4 [0268.663] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.663] lstrlenW (lpString=".1cd") returned 4 [0268.663] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0268.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0268.663] lstrlenW (lpString=".jpg") returned 4 [0268.663] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0268.664] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0268.664] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0268.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0269.383] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=16852) returned 1 [0269.383] CloseHandle (hObject=0x1f8) returned 1 [0269.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0269.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0269.384] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.384] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0269.675] GetLastError () returned 0x0 [0269.675] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0269.691] WriteFile (in: hFile=0x168, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0269.692] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.692] WriteFile (in: hFile=0x168, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0269.693] SetEndOfFile (hFile=0x168) returned 1 [0269.693] CloseHandle (hObject=0x168) returned 1 [0269.693] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.694] SetEndOfFile (hFile=0x1f8) returned 1 [0269.694] CloseHandle (hObject=0x1f8) returned 1 [0269.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0269.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.695] lstrlenW (lpString=".doc") returned 4 [0269.695] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.695] lstrlenW (lpString=".docx") returned 5 [0269.695] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0269.695] lstrlenW (lpString=".pdf") returned 4 [0269.695] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.695] lstrlenW (lpString=".xls") returned 4 [0269.695] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.695] lstrlenW (lpString=".xlsx") returned 5 [0269.695] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0269.695] lstrlenW (lpString=".ppt") returned 4 [0269.695] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.695] lstrlenW (lpString=".zip") returned 4 [0269.696] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.696] lstrlenW (lpString=".rar") returned 4 [0269.696] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.696] lstrlenW (lpString=".bz2") returned 4 [0269.696] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.696] lstrlenW (lpString=".7z") returned 3 [0269.696] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.696] lstrlenW (lpString=".dbf") returned 4 [0269.696] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.696] lstrlenW (lpString=".1cd") returned 4 [0269.696] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.696] lstrlenW (lpString=".jpg") returned 4 [0269.696] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.696] lstrlenW (lpString=".doc") returned 4 [0269.696] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.696] lstrlenW (lpString=".docx") returned 5 [0269.696] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0269.696] lstrlenW (lpString=".pdf") returned 4 [0269.696] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString=".xls") returned 4 [0269.697] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString=".xlsx") returned 5 [0269.697] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0269.697] lstrlenW (lpString=".ppt") returned 4 [0269.697] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.697] lstrlenW (lpString=".zip") returned 4 [0269.697] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.697] lstrlenW (lpString=".rar") returned 4 [0269.697] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString=".bz2") returned 4 [0269.697] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString=".7z") returned 3 [0269.697] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.697] lstrlenW (lpString=".dbf") returned 4 [0269.697] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.697] lstrlenW (lpString=".1cd") returned 4 [0269.697] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0269.697] lstrlenW (lpString=".jpg") returned 4 [0269.697] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.700] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.700] lstrlenW (lpString="SETUP.XML") returned 9 [0269.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.726] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=20577) returned 1 [0269.727] CloseHandle (hObject=0x18c) returned 1 [0269.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0269.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.727] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.727] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0269.729] GetLastError () returned 0x0 [0269.729] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x5061, lpOverlapped=0x0) returned 1 [0269.740] WriteFile (in: hFile=0x174, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0269.741] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.741] WriteFile (in: hFile=0x174, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0269.741] SetEndOfFile (hFile=0x174) returned 1 [0269.741] CloseHandle (hObject=0x174) returned 1 [0269.744] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.744] SetEndOfFile (hFile=0x18c) returned 1 [0269.745] CloseHandle (hObject=0x18c) returned 1 [0269.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.745] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0269.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.745] lstrlenW (lpString=".doc") returned 4 [0269.745] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString=".docx") returned 5 [0269.746] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.746] lstrlenW (lpString=".pdf") returned 4 [0269.746] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString=".xls") returned 4 [0269.746] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString=".xlsx") returned 5 [0269.746] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.746] lstrlenW (lpString=".ppt") returned 4 [0269.746] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.746] lstrlenW (lpString=".zip") returned 4 [0269.746] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.746] lstrlenW (lpString=".rar") returned 4 [0269.746] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString=".bz2") returned 4 [0269.746] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString=".7z") returned 3 [0269.746] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.746] lstrlenW (lpString=".dbf") returned 4 [0269.746] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.746] lstrlenW (lpString=".1cd") returned 4 [0269.746] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.746] lstrlenW (lpString=".jpg") returned 4 [0269.746] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.746] lstrlenW (lpString=".doc") returned 4 [0269.747] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString=".docx") returned 5 [0269.747] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0269.747] lstrlenW (lpString=".pdf") returned 4 [0269.747] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString=".xls") returned 4 [0269.747] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString=".xlsx") returned 5 [0269.747] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0269.747] lstrlenW (lpString=".ppt") returned 4 [0269.747] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.747] lstrlenW (lpString=".zip") returned 4 [0269.747] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0269.747] lstrlenW (lpString=".rar") returned 4 [0269.747] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString=".bz2") returned 4 [0269.747] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString=".7z") returned 3 [0269.747] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0269.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.747] lstrlenW (lpString=".dbf") returned 4 [0269.747] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.747] lstrlenW (lpString=".1cd") returned 4 [0269.747] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0269.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0269.747] lstrlenW (lpString=".jpg") returned 4 [0269.747] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0269.748] lstrcmpiW (lpString1=".HTM", lpString2=".drweb") returned 1 [0269.748] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0269.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.748] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=11463) returned 1 [0269.748] CloseHandle (hObject=0x18c) returned 1 [0269.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0269.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0269.759] GetLastError () returned 0x0 [0269.759] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0269.761] WriteFile (in: hFile=0x174, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0269.762] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.762] WriteFile (in: hFile=0x174, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0269.762] SetEndOfFile (hFile=0x174) returned 1 [0269.762] CloseHandle (hObject=0x174) returned 1 [0269.765] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.765] SetEndOfFile (hFile=0x18c) returned 1 [0269.766] CloseHandle (hObject=0x18c) returned 1 [0269.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0269.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0269.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.767] lstrlenW (lpString=".doc") returned 4 [0269.767] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0269.767] lstrlenW (lpString=".docx") returned 5 [0269.767] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0269.767] lstrlenW (lpString=".pdf") returned 4 [0269.767] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0269.767] lstrlenW (lpString=".xls") returned 4 [0269.767] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0269.767] lstrlenW (lpString=".xlsx") returned 5 [0269.767] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0269.767] lstrlenW (lpString=".ppt") returned 4 [0269.767] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0269.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.767] lstrlenW (lpString=".zip") returned 4 [0269.767] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0269.767] lstrlenW (lpString=".rar") returned 4 [0269.767] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0269.767] lstrlenW (lpString=".bz2") returned 4 [0269.767] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0269.767] lstrlenW (lpString=".7z") returned 3 [0269.767] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0269.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.767] lstrlenW (lpString=".dbf") returned 4 [0269.767] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0269.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.767] lstrlenW (lpString=".1cd") returned 4 [0269.767] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0269.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.768] lstrlenW (lpString=".jpg") returned 4 [0269.768] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.768] lstrlenW (lpString=".doc") returned 4 [0269.768] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0269.768] lstrlenW (lpString=".docx") returned 5 [0269.768] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0269.768] lstrlenW (lpString=".pdf") returned 4 [0269.768] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0269.768] lstrlenW (lpString=".xls") returned 4 [0269.768] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0269.768] lstrlenW (lpString=".xlsx") returned 5 [0269.768] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0269.768] lstrlenW (lpString=".ppt") returned 4 [0269.768] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.768] lstrlenW (lpString=".zip") returned 4 [0269.768] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0269.768] lstrlenW (lpString=".rar") returned 4 [0269.768] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0269.768] lstrlenW (lpString=".bz2") returned 4 [0269.768] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0269.768] lstrlenW (lpString=".7z") returned 3 [0269.768] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.768] lstrlenW (lpString=".dbf") returned 4 [0269.768] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0269.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.768] lstrlenW (lpString=".1cd") returned 4 [0269.768] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0269.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0269.769] lstrlenW (lpString=".jpg") returned 4 [0269.769] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0269.769] lstrcmpiW (lpString1=".XML", lpString2=".drweb") returned 1 [0269.769] lstrlenW (lpString="DATES.XML") returned 9 [0269.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.769] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=8918) returned 1 [0269.769] CloseHandle (hObject=0x18c) returned 1 [0269.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0269.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0269.769] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.770] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0269.979] GetLastError () returned 0x0 [0269.979] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0270.038] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0270.041] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.041] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0270.041] SetEndOfFile (hFile=0x204) returned 1 [0270.041] CloseHandle (hObject=0x204) returned 1 [0270.044] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.044] SetEndOfFile (hFile=0x18c) returned 1 [0270.046] CloseHandle (hObject=0x18c) returned 1 [0270.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0270.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.046] lstrlenW (lpString=".doc") returned 4 [0270.046] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.046] lstrlenW (lpString=".docx") returned 5 [0270.046] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0270.046] lstrlenW (lpString=".pdf") returned 4 [0270.047] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString=".xls") returned 4 [0270.047] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString=".xlsx") returned 5 [0270.047] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0270.047] lstrlenW (lpString=".ppt") returned 4 [0270.047] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.047] lstrlenW (lpString=".zip") returned 4 [0270.047] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.047] lstrlenW (lpString=".rar") returned 4 [0270.047] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString=".bz2") returned 4 [0270.047] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString=".7z") returned 3 [0270.047] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.047] lstrlenW (lpString=".dbf") returned 4 [0270.047] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.047] lstrlenW (lpString=".1cd") returned 4 [0270.047] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.047] lstrlenW (lpString=".jpg") returned 4 [0270.047] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.047] lstrlenW (lpString=".doc") returned 4 [0270.047] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0270.047] lstrlenW (lpString=".docx") returned 5 [0270.047] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0270.048] lstrlenW (lpString=".pdf") returned 4 [0270.048] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString=".xls") returned 4 [0270.048] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString=".xlsx") returned 5 [0270.048] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0270.048] lstrlenW (lpString=".ppt") returned 4 [0270.048] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.048] lstrlenW (lpString=".zip") returned 4 [0270.048] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0270.048] lstrlenW (lpString=".rar") returned 4 [0270.048] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString=".bz2") returned 4 [0270.048] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString=".7z") returned 3 [0270.048] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0270.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.048] lstrlenW (lpString=".dbf") returned 4 [0270.048] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.048] lstrlenW (lpString=".1cd") returned 4 [0270.048] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0270.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0270.048] lstrlenW (lpString=".jpg") returned 4 [0270.048] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0270.048] lstrcmpiW (lpString1=".DAT", lpString2=".drweb") returned -1 [0270.049] lstrlenW (lpString="STOCKS.DAT") returned 10 [0270.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0270.058] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=39017) returned 1 [0270.058] CloseHandle (hObject=0x18c) returned 1 [0270.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0270.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0270.058] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.058] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0270.058] GetLastError () returned 0x0 [0270.059] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x9869, lpOverlapped=0x0) returned 1 [0270.070] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0270.073] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.073] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0270.073] SetEndOfFile (hFile=0x204) returned 1 [0270.073] CloseHandle (hObject=0x204) returned 1 [0270.086] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.086] SetEndOfFile (hFile=0x18c) returned 1 [0270.087] CloseHandle (hObject=0x18c) returned 1 [0270.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0270.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.088] lstrlenW (lpString=".doc") returned 4 [0270.088] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0270.088] lstrlenW (lpString=".docx") returned 5 [0270.088] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0270.088] lstrlenW (lpString=".pdf") returned 4 [0270.088] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0270.088] lstrlenW (lpString=".xls") returned 4 [0270.088] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0270.088] lstrlenW (lpString=".xlsx") returned 5 [0270.088] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0270.088] lstrlenW (lpString=".ppt") returned 4 [0270.088] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0270.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.089] lstrlenW (lpString=".zip") returned 4 [0270.089] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString=".rar") returned 4 [0270.089] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString=".bz2") returned 4 [0270.089] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0270.089] lstrlenW (lpString=".7z") returned 3 [0270.089] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0270.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.089] lstrlenW (lpString=".dbf") returned 4 [0270.089] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.089] lstrlenW (lpString=".1cd") returned 4 [0270.089] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0270.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.089] lstrlenW (lpString=".jpg") returned 4 [0270.089] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.089] lstrlenW (lpString=".doc") returned 4 [0270.089] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString=".docx") returned 5 [0270.089] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0270.089] lstrlenW (lpString=".pdf") returned 4 [0270.089] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString=".xls") returned 4 [0270.089] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0270.089] lstrlenW (lpString=".xlsx") returned 5 [0270.089] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0270.090] lstrlenW (lpString=".ppt") returned 4 [0270.090] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0270.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.090] lstrlenW (lpString=".zip") returned 4 [0270.090] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0270.090] lstrlenW (lpString=".rar") returned 4 [0270.090] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0270.090] lstrlenW (lpString=".bz2") returned 4 [0270.090] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0270.090] lstrlenW (lpString=".7z") returned 3 [0270.090] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0270.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.090] lstrlenW (lpString=".dbf") returned 4 [0270.090] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0270.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.090] lstrlenW (lpString=".1cd") returned 4 [0270.090] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0270.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0270.090] lstrlenW (lpString=".jpg") returned 4 [0270.090] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0270.090] lstrcmpiW (lpString1=".TXT", lpString2=".drweb") returned 1 [0270.090] lstrlenW (lpString="METCONV.TXT") returned 11 [0270.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0270.091] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1183416) returned 1 [0270.091] CloseHandle (hObject=0x18c) returned 1 [0270.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0270.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0270.092] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.092] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0270.092] GetLastError () returned 0x0 [0270.092] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0270.165] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0270.185] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0270.195] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0270.461] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.461] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0270.461] SetEndOfFile (hFile=0x204) returned 1 [0270.461] CloseHandle (hObject=0x204) returned 1 [0270.473] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.473] SetEndOfFile (hFile=0x18c) returned 1 [0270.474] CloseHandle (hObject=0x18c) returned 1 [0270.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0270.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0270.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.475] lstrlenW (lpString=".doc") returned 4 [0270.475] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString=".docx") returned 5 [0270.475] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0270.475] lstrlenW (lpString=".pdf") returned 4 [0270.475] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString=".xls") returned 4 [0270.475] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0270.475] lstrlenW (lpString=".xlsx") returned 5 [0270.475] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0270.475] lstrlenW (lpString=".ppt") returned 4 [0270.475] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.475] lstrlenW (lpString=".zip") returned 4 [0270.475] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0270.475] lstrlenW (lpString=".rar") returned 4 [0270.475] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString=".bz2") returned 4 [0270.475] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString=".7z") returned 3 [0270.475] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0270.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.475] lstrlenW (lpString=".dbf") returned 4 [0270.475] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.475] lstrlenW (lpString=".1cd") returned 4 [0270.475] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0270.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.475] lstrlenW (lpString=".jpg") returned 4 [0270.475] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.476] lstrlenW (lpString=".doc") returned 4 [0270.476] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString=".docx") returned 5 [0270.476] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0270.476] lstrlenW (lpString=".pdf") returned 4 [0270.476] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString=".xls") returned 4 [0270.476] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0270.476] lstrlenW (lpString=".xlsx") returned 5 [0270.476] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0270.476] lstrlenW (lpString=".ppt") returned 4 [0270.476] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.476] lstrlenW (lpString=".zip") returned 4 [0270.476] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0270.476] lstrlenW (lpString=".rar") returned 4 [0270.476] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString=".bz2") returned 4 [0270.476] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString=".7z") returned 3 [0270.476] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0270.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.476] lstrlenW (lpString=".dbf") returned 4 [0270.476] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.476] lstrlenW (lpString=".1cd") returned 4 [0270.476] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0270.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0270.476] lstrlenW (lpString=".jpg") returned 4 [0270.476] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0270.477] lstrcmpiW (lpString1=".emf", lpString2=".drweb") returned 1 [0270.477] lstrlenW (lpString="Graph.emf") returned 9 [0270.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.950] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=116724) returned 1 [0270.950] CloseHandle (hObject=0x174) returned 1 [0270.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0270.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.951] lstrlenW (lpString=".doc") returned 4 [0270.951] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0270.951] lstrlenW (lpString=".docx") returned 5 [0270.951] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0270.951] lstrlenW (lpString=".pdf") returned 4 [0270.951] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0270.951] lstrlenW (lpString=".xls") returned 4 [0270.951] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0270.951] lstrlenW (lpString=".xlsx") returned 5 [0270.951] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0270.951] lstrlenW (lpString=".ppt") returned 4 [0270.951] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0270.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.951] lstrlenW (lpString=".zip") returned 4 [0270.951] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0270.951] lstrlenW (lpString=".rar") returned 4 [0270.951] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0270.951] lstrlenW (lpString=".bz2") returned 4 [0270.951] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0270.951] lstrlenW (lpString=".7z") returned 3 [0270.951] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0270.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.951] lstrlenW (lpString=".dbf") returned 4 [0270.951] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0270.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.952] lstrlenW (lpString=".1cd") returned 4 [0270.952] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0270.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.952] lstrlenW (lpString=".jpg") returned 4 [0270.952] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0270.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.952] lstrlenW (lpString=".doc") returned 4 [0270.952] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0270.952] lstrlenW (lpString=".docx") returned 5 [0270.952] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0270.952] lstrlenW (lpString=".pdf") returned 4 [0270.952] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0270.952] lstrlenW (lpString=".xls") returned 4 [0270.952] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0270.952] lstrlenW (lpString=".xlsx") returned 5 [0270.952] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0270.952] lstrlenW (lpString=".ppt") returned 4 [0270.952] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0270.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.952] lstrlenW (lpString=".zip") returned 4 [0270.952] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0270.952] lstrlenW (lpString=".rar") returned 4 [0270.952] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0270.952] lstrlenW (lpString=".bz2") returned 4 [0270.952] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0270.953] lstrlenW (lpString=".7z") returned 3 [0270.953] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0270.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.953] lstrlenW (lpString=".dbf") returned 4 [0270.953] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0270.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.953] lstrlenW (lpString=".1cd") returned 4 [0270.953] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0270.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0270.953] lstrlenW (lpString=".jpg") returned 4 [0270.953] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0270.953] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.953] lstrlenW (lpString="Small_News.jpg") returned 14 [0270.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.953] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1990) returned 1 [0270.953] CloseHandle (hObject=0x174) returned 1 [0270.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0270.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.954] lstrlenW (lpString=".doc") returned 4 [0270.954] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.954] lstrlenW (lpString=".docx") returned 5 [0270.954] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.954] lstrlenW (lpString=".pdf") returned 4 [0270.954] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.954] lstrlenW (lpString=".xls") returned 4 [0270.961] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.961] lstrlenW (lpString=".xlsx") returned 5 [0270.961] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.961] lstrlenW (lpString=".ppt") returned 4 [0270.961] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.961] lstrlenW (lpString=".zip") returned 4 [0270.961] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.961] lstrlenW (lpString=".rar") returned 4 [0270.961] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.961] lstrlenW (lpString=".bz2") returned 4 [0270.961] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.961] lstrlenW (lpString=".7z") returned 3 [0270.962] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.962] lstrlenW (lpString=".dbf") returned 4 [0270.962] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.962] lstrlenW (lpString=".1cd") returned 4 [0270.962] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.962] lstrlenW (lpString=".jpg") returned 4 [0270.962] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.962] lstrlenW (lpString=".doc") returned 4 [0270.962] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.962] lstrlenW (lpString=".docx") returned 5 [0270.962] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.962] lstrlenW (lpString=".pdf") returned 4 [0270.962] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.962] lstrlenW (lpString=".xls") returned 4 [0270.962] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.962] lstrlenW (lpString=".xlsx") returned 5 [0270.962] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.962] lstrlenW (lpString=".ppt") returned 4 [0270.962] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.962] lstrlenW (lpString=".zip") returned 4 [0270.963] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.963] lstrlenW (lpString=".rar") returned 4 [0270.963] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.963] lstrlenW (lpString=".bz2") returned 4 [0270.963] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.963] lstrlenW (lpString=".7z") returned 3 [0270.963] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.963] lstrlenW (lpString=".dbf") returned 4 [0270.963] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.963] lstrlenW (lpString=".1cd") returned 4 [0270.963] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0270.963] lstrlenW (lpString=".jpg") returned 4 [0270.963] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.963] lstrcmpiW (lpString1=".htm", lpString2=".drweb") returned 1 [0270.963] lstrlenW (lpString="Soft Blue.htm") returned 13 [0270.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.964] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=232) returned 1 [0270.964] CloseHandle (hObject=0x174) returned 1 [0270.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0270.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.969] lstrlenW (lpString=".doc") returned 4 [0270.969] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.969] lstrlenW (lpString=".docx") returned 5 [0270.969] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0270.969] lstrlenW (lpString=".pdf") returned 4 [0270.969] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.969] lstrlenW (lpString=".xls") returned 4 [0270.969] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.969] lstrlenW (lpString=".xlsx") returned 5 [0270.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0270.969] lstrlenW (lpString=".ppt") returned 4 [0270.969] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.969] lstrlenW (lpString=".zip") returned 4 [0270.969] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.970] lstrlenW (lpString=".rar") returned 4 [0270.970] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.970] lstrlenW (lpString=".bz2") returned 4 [0270.970] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.970] lstrlenW (lpString=".7z") returned 3 [0270.970] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.970] lstrlenW (lpString=".dbf") returned 4 [0270.970] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.970] lstrlenW (lpString=".1cd") returned 4 [0270.970] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.970] lstrlenW (lpString=".jpg") returned 4 [0270.970] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.970] lstrlenW (lpString=".doc") returned 4 [0270.970] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.970] lstrlenW (lpString=".docx") returned 5 [0270.971] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0270.971] lstrlenW (lpString=".pdf") returned 4 [0270.971] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.971] lstrlenW (lpString=".xls") returned 4 [0270.971] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.971] lstrlenW (lpString=".xlsx") returned 5 [0270.971] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0270.971] lstrlenW (lpString=".ppt") returned 4 [0270.971] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.971] lstrlenW (lpString=".zip") returned 4 [0270.971] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.971] lstrlenW (lpString=".rar") returned 4 [0270.971] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.971] lstrlenW (lpString=".bz2") returned 4 [0270.971] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.971] lstrlenW (lpString=".7z") returned 3 [0270.971] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.971] lstrlenW (lpString=".dbf") returned 4 [0270.971] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.971] lstrlenW (lpString=".1cd") returned 4 [0270.971] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0270.971] lstrlenW (lpString=".jpg") returned 4 [0270.971] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.972] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.972] lstrlenW (lpString="SoftBlue.jpg") returned 12 [0270.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.973] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=10569) returned 1 [0270.973] CloseHandle (hObject=0x174) returned 1 [0270.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0270.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.973] lstrlenW (lpString=".doc") returned 4 [0270.973] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.973] lstrlenW (lpString=".docx") returned 5 [0270.973] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0270.973] lstrlenW (lpString=".pdf") returned 4 [0270.974] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.974] lstrlenW (lpString=".xls") returned 4 [0270.974] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.974] lstrlenW (lpString=".xlsx") returned 5 [0270.974] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0270.974] lstrlenW (lpString=".ppt") returned 4 [0270.974] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.974] lstrlenW (lpString=".zip") returned 4 [0270.974] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.974] lstrlenW (lpString=".rar") returned 4 [0270.974] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.974] lstrlenW (lpString=".bz2") returned 4 [0270.974] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.974] lstrlenW (lpString=".7z") returned 3 [0270.974] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.974] lstrlenW (lpString=".dbf") returned 4 [0270.974] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.974] lstrlenW (lpString=".1cd") returned 4 [0270.974] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.974] lstrlenW (lpString=".jpg") returned 4 [0270.974] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.975] lstrlenW (lpString=".doc") returned 4 [0270.975] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.975] lstrlenW (lpString=".docx") returned 5 [0270.975] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0270.975] lstrlenW (lpString=".pdf") returned 4 [0270.975] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.975] lstrlenW (lpString=".xls") returned 4 [0270.975] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.975] lstrlenW (lpString=".xlsx") returned 5 [0270.975] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0270.975] lstrlenW (lpString=".ppt") returned 4 [0270.975] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.975] lstrlenW (lpString=".zip") returned 4 [0270.975] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.975] lstrlenW (lpString=".rar") returned 4 [0270.975] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.975] lstrlenW (lpString=".bz2") returned 4 [0270.975] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.975] lstrlenW (lpString=".7z") returned 3 [0270.975] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.975] lstrlenW (lpString=".dbf") returned 4 [0270.975] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0270.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.976] lstrlenW (lpString=".1cd") returned 4 [0270.976] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0270.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 70 [0270.976] lstrlenW (lpString=".jpg") returned 4 [0270.976] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0270.976] lstrcmpiW (lpString1=".htm", lpString2=".drweb") returned 1 [0270.976] lstrlenW (lpString="Stars.htm") returned 9 [0270.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.976] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=230) returned 1 [0270.976] CloseHandle (hObject=0x174) returned 1 [0270.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0270.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.977] lstrlenW (lpString=".doc") returned 4 [0270.977] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.977] lstrlenW (lpString=".docx") returned 5 [0270.977] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.977] lstrlenW (lpString=".pdf") returned 4 [0270.977] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.977] lstrlenW (lpString=".xls") returned 4 [0270.977] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.977] lstrlenW (lpString=".xlsx") returned 5 [0270.977] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.977] lstrlenW (lpString=".ppt") returned 4 [0270.977] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.977] lstrlenW (lpString=".zip") returned 4 [0270.977] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.977] lstrlenW (lpString=".rar") returned 4 [0270.977] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.977] lstrlenW (lpString=".bz2") returned 4 [0270.978] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.978] lstrlenW (lpString=".7z") returned 3 [0270.978] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.978] lstrlenW (lpString=".dbf") returned 4 [0270.978] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.978] lstrlenW (lpString=".1cd") returned 4 [0270.978] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.978] lstrlenW (lpString=".jpg") returned 4 [0270.978] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.978] lstrlenW (lpString=".doc") returned 4 [0270.978] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0270.978] lstrlenW (lpString=".docx") returned 5 [0270.978] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0270.978] lstrlenW (lpString=".pdf") returned 4 [0270.978] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0270.978] lstrlenW (lpString=".xls") returned 4 [0270.978] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0270.978] lstrlenW (lpString=".xlsx") returned 5 [0270.978] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0270.978] lstrlenW (lpString=".ppt") returned 4 [0270.978] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0270.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.978] lstrlenW (lpString=".zip") returned 4 [0270.979] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0270.979] lstrlenW (lpString=".rar") returned 4 [0270.979] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0270.979] lstrlenW (lpString=".bz2") returned 4 [0270.979] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0270.979] lstrlenW (lpString=".7z") returned 3 [0270.979] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.979] lstrlenW (lpString=".dbf") returned 4 [0270.979] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.979] lstrlenW (lpString=".1cd") returned 4 [0270.979] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0270.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67 [0270.979] lstrlenW (lpString=".jpg") returned 4 [0270.979] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0270.979] lstrcmpiW (lpString1=".jpg", lpString2=".drweb") returned 1 [0270.979] lstrlenW (lpString="Stars.jpg") returned 9 [0270.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0270.997] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=7505) returned 1 [0270.997] CloseHandle (hObject=0x174) returned 1 [0270.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0270.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0270.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0270.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67 [0270.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67 [0270.997] lstrlenW (lpString=".doc") returned 4 [0270.997] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0270.997] lstrlenW (lpString=".docx") returned 5 [0270.997] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0270.997] lstrlenW (lpString=".pdf") returned 4 [0270.998] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0270.998] lstrlenW (lpString=".xls") returned 4 [0270.998] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0270.998] lstrlenW (lpString=".xlsx") returned 5 [0270.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0270.998] lstrlenW (lpString=".ppt") returned 4 [0270.998] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0270.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67 [0270.998] lstrlenW (lpString=".zip") returned 4 [0270.998] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0270.998] lstrlenW (lpString=".rar") returned 4 [0270.998] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0270.998] lstrlenW (lpString=".bz2") returned 4 [0270.998] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0270.998] lstrlenW (lpString=".7z") returned 3 [0270.998] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0270.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67 [0270.998] lstrlenW (lpString=".dbf") returned 4 [0270.998] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0271.002] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.002] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0271.004] GetLastError () returned 0x0 [0271.004] ReadFile (in: hFile=0x174, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x621, lpOverlapped=0x0) returned 1 [0271.016] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x630, lpOverlapped=0x0) returned 1 [0271.017] ReadFile (in: hFile=0x174, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.018] WriteFile (in: hFile=0x204, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.018] SetEndOfFile (hFile=0x204) returned 1 [0271.018] CloseHandle (hObject=0x204) returned 1 [0271.019] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.019] SetEndOfFile (hFile=0x174) returned 1 [0271.020] CloseHandle (hObject=0x174) returned 1 [0271.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString=".doc") returned 4 [0271.021] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.021] lstrlenW (lpString=".docx") returned 5 [0271.021] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.021] lstrlenW (lpString=".pdf") returned 4 [0271.021] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.021] lstrlenW (lpString=".xls") returned 4 [0271.021] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.021] lstrlenW (lpString=".xlsx") returned 5 [0271.021] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.021] lstrlenW (lpString=".ppt") returned 4 [0271.021] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString=".zip") returned 4 [0271.021] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.021] lstrlenW (lpString=".rar") returned 4 [0271.021] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.021] lstrlenW (lpString=".bz2") returned 4 [0271.021] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.021] lstrlenW (lpString=".7z") returned 3 [0271.021] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString=".dbf") returned 4 [0271.021] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString=".1cd") returned 4 [0271.021] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString=".jpg") returned 4 [0271.021] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.022] lstrlenW (lpString=".doc") returned 4 [0271.022] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.022] lstrlenW (lpString=".docx") returned 5 [0271.022] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.022] lstrlenW (lpString=".pdf") returned 4 [0271.022] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.022] lstrlenW (lpString=".xls") returned 4 [0271.022] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.022] lstrlenW (lpString=".xlsx") returned 5 [0271.022] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.022] lstrlenW (lpString=".ppt") returned 4 [0271.022] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.022] lstrlenW (lpString=".zip") returned 4 [0271.022] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.022] lstrlenW (lpString=".rar") returned 4 [0271.022] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.022] lstrlenW (lpString=".bz2") returned 4 [0271.022] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.269] lstrlenW (lpString=".7z") returned 3 [0271.269] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.269] lstrlenW (lpString=".dbf") returned 4 [0271.269] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.270] lstrlenW (lpString=".1cd") returned 4 [0271.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0271.270] lstrlenW (lpString=".jpg") returned 4 [0271.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.270] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0271.270] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0271.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0271.388] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2848) returned 1 [0271.388] CloseHandle (hObject=0x174) returned 1 [0271.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0271.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0271.394] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.394] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0271.657] GetLastError () returned 0x0 [0271.657] ReadFile (in: hFile=0x174, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xb20, lpOverlapped=0x0) returned 1 [0271.697] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0271.698] ReadFile (in: hFile=0x174, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.698] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.698] SetEndOfFile (hFile=0x1f4) returned 1 [0271.698] CloseHandle (hObject=0x1f4) returned 1 [0271.698] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.698] SetEndOfFile (hFile=0x174) returned 1 [0271.699] CloseHandle (hObject=0x174) returned 1 [0271.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.700] lstrlenW (lpString=".doc") returned 4 [0271.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.700] lstrlenW (lpString=".docx") returned 5 [0271.700] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.700] lstrlenW (lpString=".pdf") returned 4 [0271.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.700] lstrlenW (lpString=".xls") returned 4 [0271.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.700] lstrlenW (lpString=".xlsx") returned 5 [0271.700] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.700] lstrlenW (lpString=".ppt") returned 4 [0271.700] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.700] lstrlenW (lpString=".zip") returned 4 [0271.700] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.700] lstrlenW (lpString=".rar") returned 4 [0271.700] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.700] lstrlenW (lpString=".bz2") returned 4 [0271.700] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.700] lstrlenW (lpString=".7z") returned 3 [0271.700] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.700] lstrlenW (lpString=".dbf") returned 4 [0271.700] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.701] lstrlenW (lpString=".1cd") returned 4 [0271.701] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.701] lstrlenW (lpString=".jpg") returned 4 [0271.701] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.701] lstrlenW (lpString=".doc") returned 4 [0271.701] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.701] lstrlenW (lpString=".docx") returned 5 [0271.701] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0271.701] lstrlenW (lpString=".pdf") returned 4 [0271.701] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.701] lstrlenW (lpString=".xls") returned 4 [0271.701] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.701] lstrlenW (lpString=".xlsx") returned 5 [0271.701] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0271.701] lstrlenW (lpString=".ppt") returned 4 [0271.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.701] lstrlenW (lpString=".zip") returned 4 [0271.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.701] lstrlenW (lpString=".rar") returned 4 [0271.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.701] lstrlenW (lpString=".bz2") returned 4 [0271.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.701] lstrlenW (lpString=".7z") returned 3 [0271.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.702] lstrlenW (lpString=".dbf") returned 4 [0271.702] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.702] lstrlenW (lpString=".1cd") returned 4 [0271.702] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0271.702] lstrlenW (lpString=".jpg") returned 4 [0271.702] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.702] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0271.702] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0271.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0271.807] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=20627) returned 1 [0271.807] CloseHandle (hObject=0x18c) returned 1 [0271.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0271.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0271.807] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.807] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0271.809] GetLastError () returned 0x0 [0271.809] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x5093, lpOverlapped=0x0) returned 1 [0271.923] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0271.925] ReadFile (in: hFile=0x18c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.925] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.925] SetEndOfFile (hFile=0x1ec) returned 1 [0271.925] CloseHandle (hObject=0x1ec) returned 1 [0271.925] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.925] SetEndOfFile (hFile=0x18c) returned 1 [0271.926] CloseHandle (hObject=0x18c) returned 1 [0271.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0271.926] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0271.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.927] lstrlenW (lpString=".doc") returned 4 [0271.927] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.927] lstrlenW (lpString=".docx") returned 5 [0271.927] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.927] lstrlenW (lpString=".pdf") returned 4 [0271.927] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.927] lstrlenW (lpString=".xls") returned 4 [0271.927] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.927] lstrlenW (lpString=".xlsx") returned 5 [0271.927] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.927] lstrlenW (lpString=".ppt") returned 4 [0271.927] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.927] lstrlenW (lpString=".zip") returned 4 [0271.927] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.927] lstrlenW (lpString=".rar") returned 4 [0271.927] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.927] lstrlenW (lpString=".bz2") returned 4 [0271.927] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.927] lstrlenW (lpString=".7z") returned 3 [0271.927] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.927] lstrlenW (lpString=".dbf") returned 4 [0271.927] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.927] lstrlenW (lpString=".1cd") returned 4 [0271.927] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.927] lstrlenW (lpString=".jpg") returned 4 [0271.928] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.928] lstrlenW (lpString=".doc") returned 4 [0271.928] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0271.928] lstrlenW (lpString=".docx") returned 5 [0271.928] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0271.928] lstrlenW (lpString=".pdf") returned 4 [0271.928] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0271.928] lstrlenW (lpString=".xls") returned 4 [0271.928] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0271.928] lstrlenW (lpString=".xlsx") returned 5 [0271.928] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0271.928] lstrlenW (lpString=".ppt") returned 4 [0271.928] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0271.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.928] lstrlenW (lpString=".zip") returned 4 [0271.928] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0271.928] lstrlenW (lpString=".rar") returned 4 [0271.928] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0271.928] lstrlenW (lpString=".bz2") returned 4 [0271.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0271.928] lstrlenW (lpString=".7z") returned 3 [0271.928] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0271.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.928] lstrlenW (lpString=".dbf") returned 4 [0271.928] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0271.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.928] lstrlenW (lpString=".1cd") returned 4 [0271.928] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0271.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0271.928] lstrlenW (lpString=".jpg") returned 4 [0271.928] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0271.929] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0271.929] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0271.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0272.037] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=27407) returned 1 [0272.037] CloseHandle (hObject=0x1b0) returned 1 [0272.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0272.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0272.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0272.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.038] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0272.038] GetLastError () returned 0x0 [0272.038] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0272.296] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0272.297] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.298] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.298] SetEndOfFile (hFile=0x18c) returned 1 [0272.298] CloseHandle (hObject=0x18c) returned 1 [0272.298] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.298] SetEndOfFile (hFile=0x1b0) returned 1 [0272.299] CloseHandle (hObject=0x1b0) returned 1 [0272.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0272.300] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0272.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.300] lstrlenW (lpString=".doc") returned 4 [0272.300] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0272.300] lstrlenW (lpString=".docx") returned 5 [0272.300] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0272.300] lstrlenW (lpString=".pdf") returned 4 [0272.300] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0272.300] lstrlenW (lpString=".xls") returned 4 [0272.300] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0272.300] lstrlenW (lpString=".xlsx") returned 5 [0272.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0272.300] lstrlenW (lpString=".ppt") returned 4 [0272.300] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0272.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.300] lstrlenW (lpString=".zip") returned 4 [0272.300] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0272.300] lstrlenW (lpString=".rar") returned 4 [0272.300] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0272.300] lstrlenW (lpString=".bz2") returned 4 [0272.300] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0272.300] lstrlenW (lpString=".7z") returned 3 [0272.300] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.301] lstrlenW (lpString=".dbf") returned 4 [0272.301] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.301] lstrlenW (lpString=".1cd") returned 4 [0272.301] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.301] lstrlenW (lpString=".jpg") returned 4 [0272.301] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.301] lstrlenW (lpString=".doc") returned 4 [0272.301] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0272.301] lstrlenW (lpString=".docx") returned 5 [0272.301] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0272.301] lstrlenW (lpString=".pdf") returned 4 [0272.301] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0272.301] lstrlenW (lpString=".xls") returned 4 [0272.301] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0272.301] lstrlenW (lpString=".xlsx") returned 5 [0272.301] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0272.301] lstrlenW (lpString=".ppt") returned 4 [0272.301] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0272.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.301] lstrlenW (lpString=".zip") returned 4 [0272.301] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0272.302] lstrlenW (lpString=".rar") returned 4 [0272.302] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0272.302] lstrlenW (lpString=".bz2") returned 4 [0272.302] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0272.302] lstrlenW (lpString=".7z") returned 3 [0272.302] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0272.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.302] lstrlenW (lpString=".dbf") returned 4 [0272.302] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0272.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.302] lstrlenW (lpString=".1cd") returned 4 [0272.302] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0272.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0272.302] lstrlenW (lpString=".jpg") returned 4 [0272.302] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0272.302] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0272.302] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0272.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0272.303] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=3479) returned 1 [0272.303] CloseHandle (hObject=0x1b0) returned 1 [0272.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0272.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0272.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0272.303] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.303] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0272.305] GetLastError () returned 0x0 [0272.305] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xd97, lpOverlapped=0x0) returned 1 [0272.336] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0272.337] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.337] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.338] SetEndOfFile (hFile=0x18c) returned 1 [0272.338] CloseHandle (hObject=0x18c) returned 1 [0272.338] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.338] SetEndOfFile (hFile=0x1b0) returned 1 [0272.339] CloseHandle (hObject=0x1b0) returned 1 [0272.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0272.339] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0272.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.339] lstrlenW (lpString=".doc") returned 4 [0272.340] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0272.340] lstrlenW (lpString=".docx") returned 5 [0272.340] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0272.340] lstrlenW (lpString=".pdf") returned 4 [0272.340] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0272.340] lstrlenW (lpString=".xls") returned 4 [0272.340] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0272.340] lstrlenW (lpString=".xlsx") returned 5 [0272.340] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0272.340] lstrlenW (lpString=".ppt") returned 4 [0272.340] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.340] lstrlenW (lpString=".zip") returned 4 [0272.340] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0272.340] lstrlenW (lpString=".rar") returned 4 [0272.340] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0272.340] lstrlenW (lpString=".bz2") returned 4 [0272.340] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0272.340] lstrlenW (lpString=".7z") returned 3 [0272.340] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.340] lstrlenW (lpString=".dbf") returned 4 [0272.340] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.340] lstrlenW (lpString=".1cd") returned 4 [0272.340] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0272.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.340] lstrlenW (lpString=".jpg") returned 4 [0272.340] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0272.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.341] lstrlenW (lpString=".doc") returned 4 [0272.341] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0272.341] lstrlenW (lpString=".docx") returned 5 [0272.341] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0272.341] lstrlenW (lpString=".pdf") returned 4 [0272.341] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0272.341] lstrlenW (lpString=".xls") returned 4 [0272.341] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0272.341] lstrlenW (lpString=".xlsx") returned 5 [0272.341] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0272.341] lstrlenW (lpString=".ppt") returned 4 [0272.341] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0272.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.341] lstrlenW (lpString=".zip") returned 4 [0272.341] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0272.341] lstrlenW (lpString=".rar") returned 4 [0272.341] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0272.341] lstrlenW (lpString=".bz2") returned 4 [0272.341] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0272.341] lstrlenW (lpString=".7z") returned 3 [0272.341] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0272.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.341] lstrlenW (lpString=".dbf") returned 4 [0272.341] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0272.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.341] lstrlenW (lpString=".1cd") returned 4 [0272.342] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0272.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0272.342] lstrlenW (lpString=".jpg") returned 4 [0272.342] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0272.342] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0272.342] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0272.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0272.342] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=31837) returned 1 [0272.342] CloseHandle (hObject=0x1b0) returned 1 [0272.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0272.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0272.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0272.343] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.343] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0272.343] GetLastError () returned 0x0 [0272.343] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0272.541] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0273.019] ReadFile (in: hFile=0x1b0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.019] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.019] SetEndOfFile (hFile=0x18c) returned 1 [0273.019] CloseHandle (hObject=0x18c) returned 1 [0273.019] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.019] SetEndOfFile (hFile=0x1b0) returned 1 [0273.020] CloseHandle (hObject=0x1b0) returned 1 [0273.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0273.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0273.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.021] lstrlenW (lpString=".doc") returned 4 [0273.021] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.021] lstrlenW (lpString=".docx") returned 5 [0273.021] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.021] lstrlenW (lpString=".pdf") returned 4 [0273.021] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.021] lstrlenW (lpString=".xls") returned 4 [0273.021] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.021] lstrlenW (lpString=".xlsx") returned 5 [0273.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.021] lstrlenW (lpString=".ppt") returned 4 [0273.021] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.021] lstrlenW (lpString=".zip") returned 4 [0273.021] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.021] lstrlenW (lpString=".rar") returned 4 [0273.021] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.021] lstrlenW (lpString=".bz2") returned 4 [0273.021] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.021] lstrlenW (lpString=".7z") returned 3 [0273.021] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.021] lstrlenW (lpString=".dbf") returned 4 [0273.021] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.021] lstrlenW (lpString=".1cd") returned 4 [0273.021] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.021] lstrlenW (lpString=".jpg") returned 4 [0273.021] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.022] lstrlenW (lpString=".doc") returned 4 [0273.022] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0273.022] lstrlenW (lpString=".docx") returned 5 [0273.022] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0273.022] lstrlenW (lpString=".pdf") returned 4 [0273.022] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0273.022] lstrlenW (lpString=".xls") returned 4 [0273.022] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0273.022] lstrlenW (lpString=".xlsx") returned 5 [0273.022] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0273.022] lstrlenW (lpString=".ppt") returned 4 [0273.022] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0273.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.022] lstrlenW (lpString=".zip") returned 4 [0273.022] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0273.022] lstrlenW (lpString=".rar") returned 4 [0273.022] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0273.022] lstrlenW (lpString=".bz2") returned 4 [0273.022] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0273.022] lstrlenW (lpString=".7z") returned 3 [0273.022] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0273.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.022] lstrlenW (lpString=".dbf") returned 4 [0273.022] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0273.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.022] lstrlenW (lpString=".1cd") returned 4 [0273.022] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0273.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0273.022] lstrlenW (lpString=".jpg") returned 4 [0273.022] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0273.023] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0273.023] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0273.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0273.523] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=43276) returned 1 [0273.523] CloseHandle (hObject=0x1f0) returned 1 [0273.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0273.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0273.523] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.523] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0273.523] GetLastError () returned 0x0 [0273.523] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0275.764] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0275.766] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.767] WriteFile (in: hFile=0x164, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.767] SetEndOfFile (hFile=0x164) returned 1 [0275.767] CloseHandle (hObject=0x164) returned 1 [0275.767] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.767] SetEndOfFile (hFile=0x1f0) returned 1 [0275.775] CloseHandle (hObject=0x1f0) returned 1 [0275.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0275.775] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0275.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.776] lstrlenW (lpString=".doc") returned 4 [0275.776] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.776] lstrlenW (lpString=".docx") returned 5 [0275.776] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.776] lstrlenW (lpString=".pdf") returned 4 [0275.776] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.776] lstrlenW (lpString=".xls") returned 4 [0275.776] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.776] lstrlenW (lpString=".xlsx") returned 5 [0275.776] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.776] lstrlenW (lpString=".ppt") returned 4 [0275.776] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.776] lstrlenW (lpString=".zip") returned 4 [0275.776] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.776] lstrlenW (lpString=".rar") returned 4 [0275.776] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.776] lstrlenW (lpString=".bz2") returned 4 [0275.776] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.776] lstrlenW (lpString=".7z") returned 3 [0275.776] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.776] lstrlenW (lpString=".dbf") returned 4 [0275.776] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.777] lstrlenW (lpString=".1cd") returned 4 [0275.777] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.777] lstrlenW (lpString=".jpg") returned 4 [0275.777] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.777] lstrlenW (lpString=".doc") returned 4 [0275.777] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0275.777] lstrlenW (lpString=".docx") returned 5 [0275.777] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0275.777] lstrlenW (lpString=".pdf") returned 4 [0275.777] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0275.777] lstrlenW (lpString=".xls") returned 4 [0275.777] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0275.777] lstrlenW (lpString=".xlsx") returned 5 [0275.777] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0275.777] lstrlenW (lpString=".ppt") returned 4 [0275.777] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0275.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.777] lstrlenW (lpString=".zip") returned 4 [0275.777] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0275.777] lstrlenW (lpString=".rar") returned 4 [0275.777] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0275.777] lstrlenW (lpString=".bz2") returned 4 [0275.777] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0275.777] lstrlenW (lpString=".7z") returned 3 [0275.777] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0275.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.777] lstrlenW (lpString=".dbf") returned 4 [0275.778] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0275.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.778] lstrlenW (lpString=".1cd") returned 4 [0275.778] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0275.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0275.778] lstrlenW (lpString=".jpg") returned 4 [0275.778] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0275.778] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0275.778] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0275.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.081] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=18817) returned 1 [0276.081] CloseHandle (hObject=0x164) returned 1 [0276.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0276.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.081] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.081] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0276.082] GetLastError () returned 0x0 [0276.082] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x4981, lpOverlapped=0x0) returned 1 [0276.084] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0276.085] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0276.085] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0276.085] SetEndOfFile (hFile=0x208) returned 1 [0276.085] CloseHandle (hObject=0x208) returned 1 [0276.086] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.086] SetEndOfFile (hFile=0x164) returned 1 [0276.089] CloseHandle (hObject=0x164) returned 1 [0276.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0276.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0276.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.090] lstrlenW (lpString=".doc") returned 4 [0276.090] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0276.090] lstrlenW (lpString=".docx") returned 5 [0276.090] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0276.090] lstrlenW (lpString=".pdf") returned 4 [0276.090] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0276.090] lstrlenW (lpString=".xls") returned 4 [0276.090] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0276.090] lstrlenW (lpString=".xlsx") returned 5 [0276.090] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0276.090] lstrlenW (lpString=".ppt") returned 4 [0276.090] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0276.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.090] lstrlenW (lpString=".zip") returned 4 [0276.090] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0276.090] lstrlenW (lpString=".rar") returned 4 [0276.090] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0276.090] lstrlenW (lpString=".bz2") returned 4 [0276.090] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0276.090] lstrlenW (lpString=".7z") returned 3 [0276.090] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0276.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.091] lstrlenW (lpString=".dbf") returned 4 [0276.091] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0276.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.091] lstrlenW (lpString=".1cd") returned 4 [0276.091] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0276.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.091] lstrlenW (lpString=".jpg") returned 4 [0276.091] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0276.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.091] lstrlenW (lpString=".doc") returned 4 [0276.091] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0276.091] lstrlenW (lpString=".docx") returned 5 [0276.091] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0276.091] lstrlenW (lpString=".pdf") returned 4 [0276.091] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0276.091] lstrlenW (lpString=".xls") returned 4 [0276.091] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0276.091] lstrlenW (lpString=".xlsx") returned 5 [0276.091] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0276.091] lstrlenW (lpString=".ppt") returned 4 [0276.091] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0276.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.091] lstrlenW (lpString=".zip") returned 4 [0276.091] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0276.091] lstrlenW (lpString=".rar") returned 4 [0276.091] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0276.092] lstrlenW (lpString=".bz2") returned 4 [0276.092] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0276.092] lstrlenW (lpString=".7z") returned 3 [0276.092] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0276.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.092] lstrlenW (lpString=".dbf") returned 4 [0276.092] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0276.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.092] lstrlenW (lpString=".1cd") returned 4 [0276.092] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0276.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0276.092] lstrlenW (lpString=".jpg") returned 4 [0276.092] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0276.092] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0276.092] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0276.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.093] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2476) returned 1 [0276.093] CloseHandle (hObject=0x164) returned 1 [0276.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0276.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.093] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.094] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0276.096] GetLastError () returned 0x0 [0276.096] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0276.097] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0276.098] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0276.098] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0276.098] SetEndOfFile (hFile=0x208) returned 1 [0276.099] CloseHandle (hObject=0x208) returned 1 [0276.099] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.099] SetEndOfFile (hFile=0x164) returned 1 [0276.100] CloseHandle (hObject=0x164) returned 1 [0276.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0276.100] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0276.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.101] lstrlenW (lpString=".doc") returned 4 [0276.101] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0276.101] lstrlenW (lpString=".docx") returned 5 [0276.101] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0276.101] lstrlenW (lpString=".pdf") returned 4 [0276.101] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0276.101] lstrlenW (lpString=".xls") returned 4 [0276.101] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0276.101] lstrlenW (lpString=".xlsx") returned 5 [0276.101] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0276.101] lstrlenW (lpString=".ppt") returned 4 [0276.101] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0276.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.101] lstrlenW (lpString=".zip") returned 4 [0276.101] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0276.101] lstrlenW (lpString=".rar") returned 4 [0276.101] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0276.101] lstrlenW (lpString=".bz2") returned 4 [0276.101] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0276.101] lstrlenW (lpString=".7z") returned 3 [0276.101] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0276.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.101] lstrlenW (lpString=".dbf") returned 4 [0276.101] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0276.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.102] lstrlenW (lpString=".1cd") returned 4 [0276.102] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0276.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.102] lstrlenW (lpString=".jpg") returned 4 [0276.102] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0276.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.102] lstrlenW (lpString=".doc") returned 4 [0276.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0276.102] lstrlenW (lpString=".docx") returned 5 [0276.102] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0276.102] lstrlenW (lpString=".pdf") returned 4 [0276.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0276.102] lstrlenW (lpString=".xls") returned 4 [0276.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0276.102] lstrlenW (lpString=".xlsx") returned 5 [0276.102] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0276.102] lstrlenW (lpString=".ppt") returned 4 [0276.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0276.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.102] lstrlenW (lpString=".zip") returned 4 [0276.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0276.102] lstrlenW (lpString=".rar") returned 4 [0276.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0276.102] lstrlenW (lpString=".bz2") returned 4 [0276.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0276.103] lstrlenW (lpString=".7z") returned 3 [0276.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0276.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.103] lstrlenW (lpString=".dbf") returned 4 [0276.103] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0276.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.103] lstrlenW (lpString=".1cd") returned 4 [0276.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0276.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0276.103] lstrlenW (lpString=".jpg") returned 4 [0276.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0276.103] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0276.103] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0276.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.104] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=19485) returned 1 [0276.104] CloseHandle (hObject=0x164) returned 1 [0276.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0276.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.104] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.104] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0276.105] GetLastError () returned 0x0 [0276.105] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0276.106] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0276.108] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0276.108] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0276.108] SetEndOfFile (hFile=0x208) returned 1 [0276.108] CloseHandle (hObject=0x208) returned 1 [0276.109] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.109] SetEndOfFile (hFile=0x164) returned 1 [0276.110] CloseHandle (hObject=0x164) returned 1 [0276.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0276.110] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0276.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.110] lstrlenW (lpString=".doc") returned 4 [0276.110] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0276.111] lstrlenW (lpString=".docx") returned 5 [0276.111] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0276.111] lstrlenW (lpString=".pdf") returned 4 [0276.111] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0276.111] lstrlenW (lpString=".xls") returned 4 [0276.111] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0276.111] lstrlenW (lpString=".xlsx") returned 5 [0276.111] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0276.111] lstrlenW (lpString=".ppt") returned 4 [0276.111] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0276.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.111] lstrlenW (lpString=".zip") returned 4 [0276.111] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0276.111] lstrlenW (lpString=".rar") returned 4 [0276.111] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0276.111] lstrlenW (lpString=".bz2") returned 4 [0276.111] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0276.111] lstrlenW (lpString=".7z") returned 3 [0276.111] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0276.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.111] lstrlenW (lpString=".dbf") returned 4 [0276.111] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0276.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.111] lstrlenW (lpString=".1cd") returned 4 [0276.111] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0276.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.111] lstrlenW (lpString=".jpg") returned 4 [0276.111] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0276.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.112] lstrlenW (lpString=".doc") returned 4 [0276.112] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0276.112] lstrlenW (lpString=".docx") returned 5 [0276.112] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0276.112] lstrlenW (lpString=".pdf") returned 4 [0276.112] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0276.112] lstrlenW (lpString=".xls") returned 4 [0276.112] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0276.112] lstrlenW (lpString=".xlsx") returned 5 [0276.112] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0276.112] lstrlenW (lpString=".ppt") returned 4 [0276.112] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0276.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.112] lstrlenW (lpString=".zip") returned 4 [0276.112] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0276.112] lstrlenW (lpString=".rar") returned 4 [0276.112] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0276.112] lstrlenW (lpString=".bz2") returned 4 [0276.112] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0276.112] lstrlenW (lpString=".7z") returned 3 [0276.112] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0276.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.112] lstrlenW (lpString=".dbf") returned 4 [0276.112] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0276.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.113] lstrlenW (lpString=".1cd") returned 4 [0276.113] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0276.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0276.113] lstrlenW (lpString=".jpg") returned 4 [0276.113] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0276.113] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0276.113] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0276.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.116] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1232) returned 1 [0276.116] CloseHandle (hObject=0x164) returned 1 [0276.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0276.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0276.116] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.116] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0276.119] GetLastError () returned 0x0 [0276.119] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0277.889] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0278.102] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.102] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0278.102] SetEndOfFile (hFile=0x208) returned 1 [0278.102] CloseHandle (hObject=0x208) returned 1 [0278.103] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.103] SetEndOfFile (hFile=0x164) returned 1 [0278.104] CloseHandle (hObject=0x164) returned 1 [0278.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.104] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0278.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.104] lstrlenW (lpString=".doc") returned 4 [0278.104] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.104] lstrlenW (lpString=".docx") returned 5 [0278.104] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.104] lstrlenW (lpString=".pdf") returned 4 [0278.104] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.105] lstrlenW (lpString=".xls") returned 4 [0278.105] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.105] lstrlenW (lpString=".xlsx") returned 5 [0278.105] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.105] lstrlenW (lpString=".ppt") returned 4 [0278.105] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.105] lstrlenW (lpString=".zip") returned 4 [0278.105] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.105] lstrlenW (lpString=".rar") returned 4 [0278.105] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.105] lstrlenW (lpString=".bz2") returned 4 [0278.105] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.105] lstrlenW (lpString=".7z") returned 3 [0278.105] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.105] lstrlenW (lpString=".dbf") returned 4 [0278.105] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.105] lstrlenW (lpString=".1cd") returned 4 [0278.105] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.105] lstrlenW (lpString=".jpg") returned 4 [0278.105] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.106] lstrlenW (lpString=".doc") returned 4 [0278.106] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.106] lstrlenW (lpString=".docx") returned 5 [0278.106] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0278.106] lstrlenW (lpString=".pdf") returned 4 [0278.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.106] lstrlenW (lpString=".xls") returned 4 [0278.106] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.106] lstrlenW (lpString=".xlsx") returned 5 [0278.106] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0278.106] lstrlenW (lpString=".ppt") returned 4 [0278.106] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.106] lstrlenW (lpString=".zip") returned 4 [0278.106] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.106] lstrlenW (lpString=".rar") returned 4 [0278.106] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.106] lstrlenW (lpString=".bz2") returned 4 [0278.106] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.106] lstrlenW (lpString=".7z") returned 3 [0278.106] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.106] lstrlenW (lpString=".dbf") returned 4 [0278.106] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.106] lstrlenW (lpString=".1cd") returned 4 [0278.106] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0278.106] lstrlenW (lpString=".jpg") returned 4 [0278.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.107] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0278.107] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0278.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0278.400] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=44850) returned 1 [0278.400] CloseHandle (hObject=0x164) returned 1 [0278.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0278.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0278.400] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.400] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0278.401] GetLastError () returned 0x0 [0278.401] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0278.451] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0278.462] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.462] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.463] SetEndOfFile (hFile=0x208) returned 1 [0278.463] CloseHandle (hObject=0x208) returned 1 [0278.463] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.463] SetEndOfFile (hFile=0x164) returned 1 [0278.464] CloseHandle (hObject=0x164) returned 1 [0278.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0278.465] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0278.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.465] lstrlenW (lpString=".doc") returned 4 [0278.465] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.465] lstrlenW (lpString=".docx") returned 5 [0278.465] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.465] lstrlenW (lpString=".pdf") returned 4 [0278.465] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.465] lstrlenW (lpString=".xls") returned 4 [0278.465] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.465] lstrlenW (lpString=".xlsx") returned 5 [0278.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.465] lstrlenW (lpString=".ppt") returned 4 [0278.465] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.466] lstrlenW (lpString=".zip") returned 4 [0278.466] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.466] lstrlenW (lpString=".rar") returned 4 [0278.466] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.466] lstrlenW (lpString=".bz2") returned 4 [0278.466] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.466] lstrlenW (lpString=".7z") returned 3 [0278.466] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.466] lstrlenW (lpString=".dbf") returned 4 [0278.466] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.466] lstrlenW (lpString=".1cd") returned 4 [0278.466] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.466] lstrlenW (lpString=".jpg") returned 4 [0278.466] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.466] lstrlenW (lpString=".doc") returned 4 [0278.466] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0278.466] lstrlenW (lpString=".docx") returned 5 [0278.466] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0278.466] lstrlenW (lpString=".pdf") returned 4 [0278.467] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0278.467] lstrlenW (lpString=".xls") returned 4 [0278.467] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0278.467] lstrlenW (lpString=".xlsx") returned 5 [0278.467] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0278.467] lstrlenW (lpString=".ppt") returned 4 [0278.467] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0278.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.467] lstrlenW (lpString=".zip") returned 4 [0278.467] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0278.467] lstrlenW (lpString=".rar") returned 4 [0278.467] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0278.467] lstrlenW (lpString=".bz2") returned 4 [0278.467] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0278.467] lstrlenW (lpString=".7z") returned 3 [0278.467] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0278.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.467] lstrlenW (lpString=".dbf") returned 4 [0278.467] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0278.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.467] lstrlenW (lpString=".1cd") returned 4 [0278.467] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0278.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0278.467] lstrlenW (lpString=".jpg") returned 4 [0278.467] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0278.468] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0278.468] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0278.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0278.468] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2574) returned 1 [0278.468] CloseHandle (hObject=0x164) returned 1 [0278.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0278.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0278.469] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.469] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0279.300] GetLastError () returned 0x0 [0279.300] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0279.524] WriteFile (in: hFile=0x1e4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0279.526] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.526] WriteFile (in: hFile=0x1e4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.526] SetEndOfFile (hFile=0x1e4) returned 1 [0279.526] CloseHandle (hObject=0x1e4) returned 1 [0279.526] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.526] SetEndOfFile (hFile=0x164) returned 1 [0279.527] CloseHandle (hObject=0x164) returned 1 [0279.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.527] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0279.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.528] lstrlenW (lpString=".doc") returned 4 [0279.528] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.528] lstrlenW (lpString=".docx") returned 5 [0279.528] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.528] lstrlenW (lpString=".pdf") returned 4 [0279.528] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.528] lstrlenW (lpString=".xls") returned 4 [0279.528] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.528] lstrlenW (lpString=".xlsx") returned 5 [0279.528] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.528] lstrlenW (lpString=".ppt") returned 4 [0279.528] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.528] lstrlenW (lpString=".zip") returned 4 [0279.528] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.528] lstrlenW (lpString=".rar") returned 4 [0279.528] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.528] lstrlenW (lpString=".bz2") returned 4 [0279.528] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.529] lstrlenW (lpString=".7z") returned 3 [0279.529] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.529] lstrlenW (lpString=".dbf") returned 4 [0279.529] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.529] lstrlenW (lpString=".1cd") returned 4 [0279.529] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.529] lstrlenW (lpString=".jpg") returned 4 [0279.529] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.529] lstrlenW (lpString=".doc") returned 4 [0279.529] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.529] lstrlenW (lpString=".docx") returned 5 [0279.529] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.529] lstrlenW (lpString=".pdf") returned 4 [0279.529] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.529] lstrlenW (lpString=".xls") returned 4 [0279.529] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.529] lstrlenW (lpString=".xlsx") returned 5 [0279.529] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.529] lstrlenW (lpString=".ppt") returned 4 [0279.529] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.530] lstrlenW (lpString=".zip") returned 4 [0279.530] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.530] lstrlenW (lpString=".rar") returned 4 [0279.530] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.530] lstrlenW (lpString=".bz2") returned 4 [0279.530] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.530] lstrlenW (lpString=".7z") returned 3 [0279.530] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.530] lstrlenW (lpString=".dbf") returned 4 [0279.530] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.530] lstrlenW (lpString=".1cd") returned 4 [0279.530] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0279.530] lstrlenW (lpString=".jpg") returned 4 [0279.530] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.530] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0279.530] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0279.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0279.531] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=4100) returned 1 [0279.531] CloseHandle (hObject=0x164) returned 1 [0279.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0279.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0279.531] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.531] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0279.550] GetLastError () returned 0x0 [0279.550] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x1004, lpOverlapped=0x0) returned 1 [0279.688] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0279.689] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.689] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.689] SetEndOfFile (hFile=0x214) returned 1 [0279.689] CloseHandle (hObject=0x214) returned 1 [0279.690] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.690] SetEndOfFile (hFile=0x164) returned 1 [0279.690] CloseHandle (hObject=0x164) returned 1 [0279.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0279.691] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0279.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.691] lstrlenW (lpString=".doc") returned 4 [0279.691] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.691] lstrlenW (lpString=".docx") returned 5 [0279.691] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.691] lstrlenW (lpString=".pdf") returned 4 [0279.691] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.691] lstrlenW (lpString=".xls") returned 4 [0279.691] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.691] lstrlenW (lpString=".xlsx") returned 5 [0279.691] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.691] lstrlenW (lpString=".ppt") returned 4 [0279.691] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.691] lstrlenW (lpString=".zip") returned 4 [0279.691] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.691] lstrlenW (lpString=".rar") returned 4 [0279.692] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.692] lstrlenW (lpString=".bz2") returned 4 [0279.693] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.693] lstrlenW (lpString=".7z") returned 3 [0279.693] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.693] lstrlenW (lpString=".dbf") returned 4 [0279.693] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.693] lstrlenW (lpString=".1cd") returned 4 [0279.693] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.693] lstrlenW (lpString=".jpg") returned 4 [0279.693] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.693] lstrlenW (lpString=".doc") returned 4 [0279.693] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0279.693] lstrlenW (lpString=".docx") returned 5 [0279.693] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0279.693] lstrlenW (lpString=".pdf") returned 4 [0279.693] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0279.693] lstrlenW (lpString=".xls") returned 4 [0279.693] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0279.693] lstrlenW (lpString=".xlsx") returned 5 [0279.693] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0279.694] lstrlenW (lpString=".ppt") returned 4 [0279.694] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0279.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.694] lstrlenW (lpString=".zip") returned 4 [0279.694] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0279.694] lstrlenW (lpString=".rar") returned 4 [0279.694] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0279.694] lstrlenW (lpString=".bz2") returned 4 [0279.694] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0279.694] lstrlenW (lpString=".7z") returned 3 [0279.694] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0279.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.694] lstrlenW (lpString=".dbf") returned 4 [0279.694] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0279.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.694] lstrlenW (lpString=".1cd") returned 4 [0279.694] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0279.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0279.694] lstrlenW (lpString=".jpg") returned 4 [0279.694] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0279.694] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0279.694] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0279.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0279.695] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=3611) returned 1 [0279.695] CloseHandle (hObject=0x164) returned 1 [0279.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0279.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0279.695] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.695] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0280.388] GetLastError () returned 0x0 [0280.388] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0281.342] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0281.343] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.343] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.343] SetEndOfFile (hFile=0x214) returned 1 [0281.344] CloseHandle (hObject=0x214) returned 1 [0281.344] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.344] SetEndOfFile (hFile=0x164) returned 1 [0281.345] CloseHandle (hObject=0x164) returned 1 [0281.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.345] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0281.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.346] lstrlenW (lpString=".doc") returned 4 [0281.346] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.346] lstrlenW (lpString=".docx") returned 5 [0281.346] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.346] lstrlenW (lpString=".pdf") returned 4 [0281.346] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.346] lstrlenW (lpString=".xls") returned 4 [0281.346] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.346] lstrlenW (lpString=".xlsx") returned 5 [0281.348] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.348] lstrlenW (lpString=".ppt") returned 4 [0281.348] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.348] lstrlenW (lpString=".zip") returned 4 [0281.348] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.348] lstrlenW (lpString=".rar") returned 4 [0281.348] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.348] lstrlenW (lpString=".bz2") returned 4 [0281.348] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.348] lstrlenW (lpString=".7z") returned 3 [0281.348] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.348] lstrlenW (lpString=".dbf") returned 4 [0281.348] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.348] lstrlenW (lpString=".1cd") returned 4 [0281.348] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.349] lstrlenW (lpString=".jpg") returned 4 [0281.349] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.349] lstrlenW (lpString=".doc") returned 4 [0281.349] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.349] lstrlenW (lpString=".docx") returned 5 [0281.349] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.349] lstrlenW (lpString=".pdf") returned 4 [0281.349] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.349] lstrlenW (lpString=".xls") returned 4 [0281.349] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.349] lstrlenW (lpString=".xlsx") returned 5 [0281.349] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.349] lstrlenW (lpString=".ppt") returned 4 [0281.349] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.349] lstrlenW (lpString=".zip") returned 4 [0281.349] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.349] lstrlenW (lpString=".rar") returned 4 [0281.349] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.349] lstrlenW (lpString=".bz2") returned 4 [0281.349] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.350] lstrlenW (lpString=".7z") returned 3 [0281.350] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.350] lstrlenW (lpString=".dbf") returned 4 [0281.350] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.350] lstrlenW (lpString=".1cd") returned 4 [0281.350] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0281.350] lstrlenW (lpString=".jpg") returned 4 [0281.350] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.350] lstrcmpiW (lpString1=".GIF", lpString2=".drweb") returned 1 [0281.350] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0281.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0281.920] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1009) returned 1 [0281.920] CloseHandle (hObject=0x208) returned 1 [0281.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0281.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0281.921] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.921] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0281.922] GetLastError () returned 0x0 [0281.922] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0281.970] WriteFile (in: hFile=0x210, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x400, lpOverlapped=0x0) returned 1 [0281.972] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.972] WriteFile (in: hFile=0x210, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0281.972] SetEndOfFile (hFile=0x210) returned 1 [0281.972] CloseHandle (hObject=0x210) returned 1 [0281.972] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.972] SetEndOfFile (hFile=0x208) returned 1 [0281.974] CloseHandle (hObject=0x208) returned 1 [0281.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.974] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.974] lstrlenW (lpString=".doc") returned 4 [0281.974] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.974] lstrlenW (lpString=".docx") returned 5 [0281.974] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.974] lstrlenW (lpString=".pdf") returned 4 [0281.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.974] lstrlenW (lpString=".xls") returned 4 [0281.975] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.975] lstrlenW (lpString=".xlsx") returned 5 [0281.975] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.975] lstrlenW (lpString=".ppt") returned 4 [0281.975] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.975] lstrlenW (lpString=".zip") returned 4 [0281.975] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.975] lstrlenW (lpString=".rar") returned 4 [0281.975] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.975] lstrlenW (lpString=".bz2") returned 4 [0281.975] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.975] lstrlenW (lpString=".7z") returned 3 [0281.975] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.975] lstrlenW (lpString=".dbf") returned 4 [0281.975] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.975] lstrlenW (lpString=".1cd") returned 4 [0281.975] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.975] lstrlenW (lpString=".jpg") returned 4 [0281.975] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.975] lstrlenW (lpString=".doc") returned 4 [0281.975] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0281.975] lstrlenW (lpString=".docx") returned 5 [0281.976] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0281.976] lstrlenW (lpString=".pdf") returned 4 [0281.976] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0281.976] lstrlenW (lpString=".xls") returned 4 [0281.976] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0281.976] lstrlenW (lpString=".xlsx") returned 5 [0281.976] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0281.976] lstrlenW (lpString=".ppt") returned 4 [0281.976] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0281.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.976] lstrlenW (lpString=".zip") returned 4 [0281.976] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0281.976] lstrlenW (lpString=".rar") returned 4 [0281.976] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0281.976] lstrlenW (lpString=".bz2") returned 4 [0281.976] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0281.976] lstrlenW (lpString=".7z") returned 3 [0281.976] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0281.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.976] lstrlenW (lpString=".dbf") returned 4 [0281.976] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0281.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.976] lstrlenW (lpString=".1cd") returned 4 [0281.976] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0281.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0281.976] lstrlenW (lpString=".jpg") returned 4 [0281.976] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0281.977] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0281.977] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0281.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0281.977] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=44302) returned 1 [0281.977] CloseHandle (hObject=0x208) returned 1 [0281.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0281.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0281.978] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.978] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0281.978] GetLastError () returned 0x0 [0281.978] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0281.990] WriteFile (in: hFile=0x210, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0281.992] ReadFile (in: hFile=0x208, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0281.992] WriteFile (in: hFile=0x210, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.992] SetEndOfFile (hFile=0x210) returned 1 [0281.992] CloseHandle (hObject=0x210) returned 1 [0281.993] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.993] SetEndOfFile (hFile=0x208) returned 1 [0281.994] CloseHandle (hObject=0x208) returned 1 [0281.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0281.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0281.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.994] lstrlenW (lpString=".doc") returned 4 [0281.995] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.995] lstrlenW (lpString=".docx") returned 5 [0281.995] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.995] lstrlenW (lpString=".pdf") returned 4 [0281.995] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.995] lstrlenW (lpString=".xls") returned 4 [0281.995] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.995] lstrlenW (lpString=".xlsx") returned 5 [0281.995] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.995] lstrlenW (lpString=".ppt") returned 4 [0281.995] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.995] lstrlenW (lpString=".zip") returned 4 [0281.995] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.995] lstrlenW (lpString=".rar") returned 4 [0281.995] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.995] lstrlenW (lpString=".bz2") returned 4 [0281.995] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.995] lstrlenW (lpString=".7z") returned 3 [0281.995] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.995] lstrlenW (lpString=".dbf") returned 4 [0281.995] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.995] lstrlenW (lpString=".1cd") returned 4 [0281.995] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.995] lstrlenW (lpString=".jpg") returned 4 [0281.996] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.996] lstrlenW (lpString=".doc") returned 4 [0281.996] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0281.996] lstrlenW (lpString=".docx") returned 5 [0281.996] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0281.996] lstrlenW (lpString=".pdf") returned 4 [0281.996] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0281.996] lstrlenW (lpString=".xls") returned 4 [0281.996] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0281.996] lstrlenW (lpString=".xlsx") returned 5 [0281.996] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0281.996] lstrlenW (lpString=".ppt") returned 4 [0281.996] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0281.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.996] lstrlenW (lpString=".zip") returned 4 [0281.996] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0281.996] lstrlenW (lpString=".rar") returned 4 [0281.996] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0281.996] lstrlenW (lpString=".bz2") returned 4 [0281.996] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0281.996] lstrlenW (lpString=".7z") returned 3 [0281.996] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0281.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.996] lstrlenW (lpString=".dbf") returned 4 [0281.996] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0281.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.997] lstrlenW (lpString=".1cd") returned 4 [0281.997] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0281.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0281.997] lstrlenW (lpString=".jpg") returned 4 [0281.997] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0281.997] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0281.997] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0281.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.000] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=42453) returned 1 [0282.000] CloseHandle (hObject=0x210) returned 1 [0282.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0282.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.000] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.000] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0282.001] GetLastError () returned 0x0 [0282.001] ReadFile (in: hFile=0x210, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0282.024] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0282.026] ReadFile (in: hFile=0x210, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.026] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0282.026] SetEndOfFile (hFile=0x214) returned 1 [0282.026] CloseHandle (hObject=0x214) returned 1 [0282.026] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.026] SetEndOfFile (hFile=0x210) returned 1 [0282.028] CloseHandle (hObject=0x210) returned 1 [0282.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.028] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0282.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.028] lstrlenW (lpString=".doc") returned 4 [0282.028] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0282.028] lstrlenW (lpString=".docx") returned 5 [0282.028] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0282.028] lstrlenW (lpString=".pdf") returned 4 [0282.028] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0282.028] lstrlenW (lpString=".xls") returned 4 [0282.029] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0282.029] lstrlenW (lpString=".xlsx") returned 5 [0282.029] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0282.029] lstrlenW (lpString=".ppt") returned 4 [0282.029] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0282.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.029] lstrlenW (lpString=".zip") returned 4 [0282.029] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0282.029] lstrlenW (lpString=".rar") returned 4 [0282.029] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0282.029] lstrlenW (lpString=".bz2") returned 4 [0282.029] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0282.029] lstrlenW (lpString=".7z") returned 3 [0282.029] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0282.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.029] lstrlenW (lpString=".dbf") returned 4 [0282.029] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0282.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.029] lstrlenW (lpString=".1cd") returned 4 [0282.029] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0282.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.029] lstrlenW (lpString=".jpg") returned 4 [0282.029] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0282.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.029] lstrlenW (lpString=".doc") returned 4 [0282.029] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0282.030] lstrlenW (lpString=".docx") returned 5 [0282.030] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0282.030] lstrlenW (lpString=".pdf") returned 4 [0282.030] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0282.030] lstrlenW (lpString=".xls") returned 4 [0282.030] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0282.030] lstrlenW (lpString=".xlsx") returned 5 [0282.030] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0282.030] lstrlenW (lpString=".ppt") returned 4 [0282.030] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0282.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.030] lstrlenW (lpString=".zip") returned 4 [0282.030] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0282.030] lstrlenW (lpString=".rar") returned 4 [0282.030] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0282.030] lstrlenW (lpString=".bz2") returned 4 [0282.030] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0282.030] lstrlenW (lpString=".7z") returned 3 [0282.030] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0282.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.030] lstrlenW (lpString=".dbf") returned 4 [0282.030] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0282.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.030] lstrlenW (lpString=".1cd") returned 4 [0282.030] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0282.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0282.030] lstrlenW (lpString=".jpg") returned 4 [0282.030] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0282.031] lstrcmpiW (lpString1=".PNG", lpString2=".drweb") returned 1 [0282.031] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0282.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.032] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=30170) returned 1 [0282.032] CloseHandle (hObject=0x210) returned 1 [0282.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0282.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0282.032] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.032] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0282.033] GetLastError () returned 0x0 [0282.033] ReadFile (in: hFile=0x210, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x75da, lpOverlapped=0x0) returned 1 [0282.046] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0282.047] ReadFile (in: hFile=0x210, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.047] WriteFile (in: hFile=0x214, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0282.047] SetEndOfFile (hFile=0x214) returned 1 [0282.047] CloseHandle (hObject=0x214) returned 1 [0282.048] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.048] SetEndOfFile (hFile=0x210) returned 1 [0282.048] CloseHandle (hObject=0x210) returned 1 [0282.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0282.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.049] lstrlenW (lpString=".doc") returned 4 [0282.049] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0282.049] lstrlenW (lpString=".docx") returned 5 [0282.049] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0282.049] lstrlenW (lpString=".pdf") returned 4 [0282.049] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0282.049] lstrlenW (lpString=".xls") returned 4 [0282.049] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0282.049] lstrlenW (lpString=".xlsx") returned 5 [0282.049] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0282.049] lstrlenW (lpString=".ppt") returned 4 [0282.049] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0282.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.049] lstrlenW (lpString=".zip") returned 4 [0282.049] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0282.049] lstrlenW (lpString=".rar") returned 4 [0282.049] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0282.049] lstrlenW (lpString=".bz2") returned 4 [0282.049] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0282.049] lstrlenW (lpString=".7z") returned 3 [0282.049] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.050] lstrlenW (lpString=".dbf") returned 4 [0282.050] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.050] lstrlenW (lpString=".1cd") returned 4 [0282.050] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.050] lstrlenW (lpString=".jpg") returned 4 [0282.050] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.050] lstrlenW (lpString=".doc") returned 4 [0282.050] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0282.050] lstrlenW (lpString=".docx") returned 5 [0282.050] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0282.050] lstrlenW (lpString=".pdf") returned 4 [0282.050] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0282.050] lstrlenW (lpString=".xls") returned 4 [0282.050] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0282.050] lstrlenW (lpString=".xlsx") returned 5 [0282.050] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0282.050] lstrlenW (lpString=".ppt") returned 4 [0282.050] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.050] lstrlenW (lpString=".zip") returned 4 [0282.050] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0282.050] lstrlenW (lpString=".rar") returned 4 [0282.050] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0282.050] lstrlenW (lpString=".bz2") returned 4 [0282.050] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0282.050] lstrlenW (lpString=".7z") returned 3 [0282.050] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0282.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.051] lstrlenW (lpString=".dbf") returned 4 [0282.051] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0282.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.051] lstrlenW (lpString=".1cd") returned 4 [0282.051] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0282.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0282.051] lstrlenW (lpString=".jpg") returned 4 [0282.051] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0282.051] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0282.051] lstrlenW (lpString="VBCN6.CHM") returned 9 [0282.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0282.237] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=109718) returned 1 [0282.237] CloseHandle (hObject=0x164) returned 1 [0282.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0282.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0282.238] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.238] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0282.238] GetLastError () returned 0x0 [0282.238] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0282.286] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0282.289] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.289] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.289] SetEndOfFile (hFile=0x1f8) returned 1 [0282.289] CloseHandle (hObject=0x1f8) returned 1 [0282.289] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.289] SetEndOfFile (hFile=0x164) returned 1 [0282.291] CloseHandle (hObject=0x164) returned 1 [0282.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0282.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.291] lstrlenW (lpString=".doc") returned 4 [0282.292] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString=".docx") returned 5 [0282.292] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.292] lstrlenW (lpString=".pdf") returned 4 [0282.292] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString=".xls") returned 4 [0282.292] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString=".xlsx") returned 5 [0282.292] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.292] lstrlenW (lpString=".ppt") returned 4 [0282.292] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.292] lstrlenW (lpString=".zip") returned 4 [0282.292] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString=".rar") returned 4 [0282.292] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString=".bz2") returned 4 [0282.292] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.292] lstrlenW (lpString=".7z") returned 3 [0282.292] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.292] lstrlenW (lpString=".dbf") returned 4 [0282.292] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.292] lstrlenW (lpString=".1cd") returned 4 [0282.292] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.293] lstrlenW (lpString=".jpg") returned 4 [0282.293] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.293] lstrlenW (lpString=".doc") returned 4 [0282.293] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString=".docx") returned 5 [0282.293] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.293] lstrlenW (lpString=".pdf") returned 4 [0282.293] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString=".xls") returned 4 [0282.293] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString=".xlsx") returned 5 [0282.293] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.293] lstrlenW (lpString=".ppt") returned 4 [0282.293] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.293] lstrlenW (lpString=".zip") returned 4 [0282.293] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString=".rar") returned 4 [0282.293] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.293] lstrlenW (lpString=".bz2") returned 4 [0282.293] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.293] lstrlenW (lpString=".7z") returned 3 [0282.293] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.293] lstrlenW (lpString=".dbf") returned 4 [0282.294] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.294] lstrlenW (lpString=".1cd") returned 4 [0282.294] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0282.294] lstrlenW (lpString=".jpg") returned 4 [0282.294] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.294] lstrcmpiW (lpString1=".CHM", lpString2=".drweb") returned -1 [0282.294] lstrlenW (lpString="VBOB6.CHM") returned 9 [0282.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0282.294] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=123956) returned 1 [0282.294] CloseHandle (hObject=0x164) returned 1 [0282.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0282.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0282.295] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.295] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0282.295] GetLastError () returned 0x0 [0282.295] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0282.502] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0282.505] ReadFile (in: hFile=0x164, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0282.505] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0282.506] SetEndOfFile (hFile=0x1f8) returned 1 [0282.506] CloseHandle (hObject=0x1f8) returned 1 [0282.506] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0282.506] SetEndOfFile (hFile=0x164) returned 1 [0282.507] CloseHandle (hObject=0x164) returned 1 [0282.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0282.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0282.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.508] lstrlenW (lpString=".doc") returned 4 [0282.508] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.508] lstrlenW (lpString=".docx") returned 5 [0282.508] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.508] lstrlenW (lpString=".pdf") returned 4 [0282.508] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.508] lstrlenW (lpString=".xls") returned 4 [0282.508] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.508] lstrlenW (lpString=".xlsx") returned 5 [0282.508] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.508] lstrlenW (lpString=".ppt") returned 4 [0282.508] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.509] lstrlenW (lpString=".zip") returned 4 [0282.509] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString=".rar") returned 4 [0282.509] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString=".bz2") returned 4 [0282.509] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.509] lstrlenW (lpString=".7z") returned 3 [0282.509] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.509] lstrlenW (lpString=".dbf") returned 4 [0282.509] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.509] lstrlenW (lpString=".1cd") returned 4 [0282.509] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.509] lstrlenW (lpString=".jpg") returned 4 [0282.509] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.509] lstrlenW (lpString=".doc") returned 4 [0282.509] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString=".docx") returned 5 [0282.509] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0282.509] lstrlenW (lpString=".pdf") returned 4 [0282.509] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString=".xls") returned 4 [0282.509] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0282.509] lstrlenW (lpString=".xlsx") returned 5 [0282.510] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0282.510] lstrlenW (lpString=".ppt") returned 4 [0282.510] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0282.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.510] lstrlenW (lpString=".zip") returned 4 [0282.510] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0282.510] lstrlenW (lpString=".rar") returned 4 [0282.510] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0282.510] lstrlenW (lpString=".bz2") returned 4 [0282.510] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0282.510] lstrlenW (lpString=".7z") returned 3 [0282.510] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0282.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.510] lstrlenW (lpString=".dbf") returned 4 [0282.510] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0282.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.510] lstrlenW (lpString=".1cd") returned 4 [0282.510] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0282.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0282.510] lstrlenW (lpString=".jpg") returned 4 [0282.510] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0282.510] lstrcmpiW (lpString1=".bmp", lpString2=".drweb") returned -1 [0282.510] lstrlenW (lpString="verisign.bmp") returned 12 [0282.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0282.513] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2702) returned 1 [0282.513] CloseHandle (hObject=0x164) returned 1 [0282.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0282.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.513] lstrlenW (lpString=".doc") returned 4 [0282.513] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0282.513] lstrlenW (lpString=".docx") returned 5 [0282.513] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0282.513] lstrlenW (lpString=".pdf") returned 4 [0282.514] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString=".xls") returned 4 [0282.514] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString=".xlsx") returned 5 [0282.514] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0282.514] lstrlenW (lpString=".ppt") returned 4 [0282.514] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.514] lstrlenW (lpString=".zip") returned 4 [0282.514] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString=".rar") returned 4 [0282.514] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString=".bz2") returned 4 [0282.514] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString=".7z") returned 3 [0282.514] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0282.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.514] lstrlenW (lpString=".dbf") returned 4 [0282.514] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.514] lstrlenW (lpString=".1cd") returned 4 [0282.514] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0282.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.514] lstrlenW (lpString=".jpg") returned 4 [0282.514] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0282.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.515] lstrlenW (lpString=".doc") returned 4 [0282.515] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString=".docx") returned 5 [0282.515] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0282.515] lstrlenW (lpString=".pdf") returned 4 [0282.515] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString=".xls") returned 4 [0282.515] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString=".xlsx") returned 5 [0282.515] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0282.515] lstrlenW (lpString=".ppt") returned 4 [0282.515] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.515] lstrlenW (lpString=".zip") returned 4 [0282.515] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString=".rar") returned 4 [0282.515] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString=".bz2") returned 4 [0282.515] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString=".7z") returned 3 [0282.515] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0282.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.515] lstrlenW (lpString=".dbf") returned 4 [0282.515] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0282.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.515] lstrlenW (lpString=".1cd") returned 4 [0282.515] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0282.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0282.515] lstrlenW (lpString=".jpg") returned 4 [0282.516] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0282.516] lstrcmpiW (lpString1=".inc", lpString2=".drweb") returned 1 [0282.516] lstrlenW (lpString="adojavas.inc") returned 12 [0282.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0282.517] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=14610) returned 1 [0282.517] CloseHandle (hObject=0x164) returned 1 [0282.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0282.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.518] lstrlenW (lpString=".doc") returned 4 [0282.518] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0282.518] lstrlenW (lpString=".docx") returned 5 [0282.518] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0282.518] lstrlenW (lpString=".pdf") returned 4 [0282.518] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0282.518] lstrlenW (lpString=".xls") returned 4 [0282.518] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0282.518] lstrlenW (lpString=".xlsx") returned 5 [0282.518] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0282.518] lstrlenW (lpString=".ppt") returned 4 [0282.518] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0282.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.518] lstrlenW (lpString=".zip") returned 4 [0282.518] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0282.518] lstrlenW (lpString=".rar") returned 4 [0282.518] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0282.518] lstrlenW (lpString=".bz2") returned 4 [0282.518] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0282.518] lstrlenW (lpString=".7z") returned 3 [0282.518] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0282.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.518] lstrlenW (lpString=".dbf") returned 4 [0282.518] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0282.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.518] lstrlenW (lpString=".1cd") returned 4 [0282.518] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0282.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.518] lstrlenW (lpString=".jpg") returned 4 [0282.518] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0282.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.519] lstrlenW (lpString=".doc") returned 4 [0282.519] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0282.519] lstrlenW (lpString=".docx") returned 5 [0282.519] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0282.519] lstrlenW (lpString=".pdf") returned 4 [0282.519] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0282.519] lstrlenW (lpString=".xls") returned 4 [0282.519] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0282.519] lstrlenW (lpString=".xlsx") returned 5 [0282.519] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0282.519] lstrlenW (lpString=".ppt") returned 4 [0282.519] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0282.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.519] lstrlenW (lpString=".zip") returned 4 [0282.519] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0282.519] lstrlenW (lpString=".rar") returned 4 [0282.519] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0282.519] lstrlenW (lpString=".bz2") returned 4 [0282.519] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0282.519] lstrlenW (lpString=".7z") returned 3 [0282.519] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0282.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.519] lstrlenW (lpString=".dbf") returned 4 [0282.519] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0282.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.571] lstrlenW (lpString=".1cd") returned 4 [0282.571] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0282.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0282.571] lstrlenW (lpString=".jpg") returned 4 [0282.571] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0282.572] lstrcmpiW (lpString1=".inc", lpString2=".drweb") returned 1 [0282.572] lstrlenW (lpString="adcvbs.inc") returned 10 [0282.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0282.698] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=623) returned 1 [0282.698] CloseHandle (hObject=0x1f8) returned 1 [0282.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0282.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.698] lstrlenW (lpString=".doc") returned 4 [0282.698] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0282.698] lstrlenW (lpString=".docx") returned 5 [0282.698] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0282.698] lstrlenW (lpString=".pdf") returned 4 [0282.698] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0282.698] lstrlenW (lpString=".xls") returned 4 [0282.698] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0282.698] lstrlenW (lpString=".xlsx") returned 5 [0282.698] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0282.698] lstrlenW (lpString=".ppt") returned 4 [0282.698] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0282.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.699] lstrlenW (lpString=".zip") returned 4 [0282.699] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0282.699] lstrlenW (lpString=".rar") returned 4 [0282.699] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0282.699] lstrlenW (lpString=".bz2") returned 4 [0282.699] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0282.699] lstrlenW (lpString=".7z") returned 3 [0282.699] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0282.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.699] lstrlenW (lpString=".dbf") returned 4 [0282.699] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0282.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.699] lstrlenW (lpString=".1cd") returned 4 [0282.699] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0282.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.699] lstrlenW (lpString=".jpg") returned 4 [0282.699] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0282.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.699] lstrlenW (lpString=".doc") returned 4 [0282.699] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0282.699] lstrlenW (lpString=".docx") returned 5 [0282.699] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0282.699] lstrlenW (lpString=".pdf") returned 4 [0282.699] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0282.699] lstrlenW (lpString=".xls") returned 4 [0282.699] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0282.699] lstrlenW (lpString=".xlsx") returned 5 [0282.699] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0282.699] lstrlenW (lpString=".ppt") returned 4 [0282.699] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0282.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.700] lstrlenW (lpString=".zip") returned 4 [0282.700] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0282.700] lstrlenW (lpString=".rar") returned 4 [0282.700] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0282.700] lstrlenW (lpString=".bz2") returned 4 [0282.700] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0282.700] lstrlenW (lpString=".7z") returned 3 [0282.700] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0282.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.700] lstrlenW (lpString=".dbf") returned 4 [0282.700] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0282.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.700] lstrlenW (lpString=".1cd") returned 4 [0282.700] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0282.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0282.700] lstrlenW (lpString=".jpg") returned 4 [0282.700] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0282.700] lstrcmpiW (lpString1=".png", lpString2=".drweb") returned 1 [0282.700] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0282.700] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0282.921] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=3118) returned 1 [0282.921] CloseHandle (hObject=0x218) returned 1 [0282.921] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0282.921] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.921] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0282.921] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.921] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.921] lstrlenW (lpString=".doc") returned 4 [0282.921] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0282.921] lstrlenW (lpString=".docx") returned 5 [0282.921] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0282.921] lstrlenW (lpString=".pdf") returned 4 [0282.921] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0282.921] lstrlenW (lpString=".xls") returned 4 [0282.922] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0282.922] lstrlenW (lpString=".xlsx") returned 5 [0282.922] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0282.922] lstrlenW (lpString=".ppt") returned 4 [0282.922] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0282.922] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.922] lstrlenW (lpString=".zip") returned 4 [0282.922] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0282.922] lstrlenW (lpString=".rar") returned 4 [0282.922] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0282.922] lstrlenW (lpString=".bz2") returned 4 [0282.922] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0282.922] lstrlenW (lpString=".7z") returned 3 [0282.922] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.922] lstrlenW (lpString=".dbf") returned 4 [0282.922] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.922] lstrlenW (lpString=".1cd") returned 4 [0282.922] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.922] lstrlenW (lpString=".jpg") returned 4 [0282.922] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0282.922] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.922] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.922] lstrlenW (lpString=".doc") returned 4 [0282.922] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0282.922] lstrlenW (lpString=".docx") returned 5 [0282.922] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0282.922] lstrlenW (lpString=".pdf") returned 4 [0282.922] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0282.922] lstrlenW (lpString=".xls") returned 4 [0282.923] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0282.923] lstrlenW (lpString=".xlsx") returned 5 [0282.923] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0282.923] lstrlenW (lpString=".ppt") returned 4 [0282.923] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0282.923] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.923] lstrlenW (lpString=".zip") returned 4 [0282.923] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0282.923] lstrlenW (lpString=".rar") returned 4 [0282.923] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0282.923] lstrlenW (lpString=".bz2") returned 4 [0282.923] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0282.923] lstrlenW (lpString=".7z") returned 3 [0282.923] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0282.923] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.923] lstrlenW (lpString=".dbf") returned 4 [0282.923] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0282.923] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.923] lstrlenW (lpString=".1cd") returned 4 [0282.923] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0282.923] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0282.923] lstrlenW (lpString=".jpg") returned 4 [0282.923] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0282.923] lstrcmpiW (lpString1=".png", lpString2=".drweb") returned 1 [0282.923] lstrlenW (lpString="pushplaysubpicture.png") returned 22 [0282.923] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0283.284] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2962) returned 1 [0283.284] CloseHandle (hObject=0x1c0) returned 1 [0283.284] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0283.285] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.285] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.285] lstrlenW (lpString=".doc") returned 4 [0283.285] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.285] lstrlenW (lpString=".docx") returned 5 [0283.285] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0283.285] lstrlenW (lpString=".pdf") returned 4 [0283.285] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.285] lstrlenW (lpString=".xls") returned 4 [0283.285] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.285] lstrlenW (lpString=".xlsx") returned 5 [0283.285] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0283.285] lstrlenW (lpString=".ppt") returned 4 [0283.285] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.285] lstrlenW (lpString=".zip") returned 4 [0283.285] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.285] lstrlenW (lpString=".rar") returned 4 [0283.285] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.285] lstrlenW (lpString=".bz2") returned 4 [0283.285] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.285] lstrlenW (lpString=".7z") returned 3 [0283.286] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.286] lstrlenW (lpString=".dbf") returned 4 [0283.286] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.286] lstrlenW (lpString=".1cd") returned 4 [0283.286] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.286] lstrlenW (lpString=".jpg") returned 4 [0283.286] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.286] lstrlenW (lpString=".doc") returned 4 [0283.286] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.286] lstrlenW (lpString=".docx") returned 5 [0283.286] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0283.286] lstrlenW (lpString=".pdf") returned 4 [0283.286] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.286] lstrlenW (lpString=".xls") returned 4 [0283.286] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.286] lstrlenW (lpString=".xlsx") returned 5 [0283.286] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0283.286] lstrlenW (lpString=".ppt") returned 4 [0283.286] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.286] lstrlenW (lpString=".zip") returned 4 [0283.286] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.286] lstrlenW (lpString=".rar") returned 4 [0283.287] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.287] lstrlenW (lpString=".bz2") returned 4 [0283.287] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.287] lstrlenW (lpString=".7z") returned 3 [0283.287] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.287] lstrlenW (lpString=".dbf") returned 4 [0283.287] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.287] lstrlenW (lpString=".1cd") returned 4 [0283.287] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0283.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0283.287] lstrlenW (lpString=".jpg") returned 4 [0283.287] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0283.287] lstrcmpiW (lpString1=".png", lpString2=".drweb") returned 1 [0283.287] lstrlenW (lpString="huemainsubpicture2.png") returned 22 [0283.287] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0283.393] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2903) returned 1 [0283.393] CloseHandle (hObject=0x1f8) returned 1 [0283.393] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0283.394] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.394] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0283.394] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0283.394] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0283.394] lstrlenW (lpString=".doc") returned 4 [0283.394] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0283.394] lstrlenW (lpString=".docx") returned 5 [0283.394] lstrcmpiW (lpString1=".docx", lpString2="2.png") returned -1 [0283.394] lstrlenW (lpString=".pdf") returned 4 [0283.394] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0283.394] lstrlenW (lpString=".xls") returned 4 [0283.394] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0283.394] lstrlenW (lpString=".xlsx") returned 5 [0283.394] lstrcmpiW (lpString1=".xlsx", lpString2="2.png") returned -1 [0283.394] lstrlenW (lpString=".ppt") returned 4 [0283.394] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0283.394] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0283.394] lstrlenW (lpString=".zip") returned 4 [0283.394] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0283.394] lstrlenW (lpString=".rar") returned 4 [0283.394] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0283.394] lstrlenW (lpString=".bz2") returned 4 [0283.394] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0283.394] lstrlenW (lpString=".7z") returned 3 [0283.394] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0283.394] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 75 [0283.394] lstrlenW (lpString=".dbf") returned 4 [0283.394] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0283.418] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.418] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0283.910] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0 [0284.633] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.633] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0284.634] GetLastError () returned 0x0 [0284.634] ReadFile (in: hFile=0x20c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x712e, lpOverlapped=0x0) returned 1 [0284.648] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0284.649] ReadFile (in: hFile=0x20c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0284.649] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0284.650] SetEndOfFile (hFile=0x1dc) returned 1 [0284.650] CloseHandle (hObject=0x1dc) returned 1 [0284.650] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0284.650] SetEndOfFile (hFile=0x20c) returned 1 [0284.651] CloseHandle (hObject=0x20c) returned 1 [0284.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0284.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.653] lstrlenW (lpString=".doc") returned 4 [0284.654] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0284.654] lstrlenW (lpString=".docx") returned 5 [0284.654] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0284.654] lstrlenW (lpString=".pdf") returned 4 [0284.654] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0284.654] lstrlenW (lpString=".xls") returned 4 [0284.654] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0284.654] lstrlenW (lpString=".xlsx") returned 5 [0284.654] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0284.654] lstrlenW (lpString=".ppt") returned 4 [0284.654] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0284.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.654] lstrlenW (lpString=".zip") returned 4 [0284.654] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0284.654] lstrlenW (lpString=".rar") returned 4 [0284.654] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0284.654] lstrlenW (lpString=".bz2") returned 4 [0284.654] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0284.654] lstrlenW (lpString=".7z") returned 3 [0284.654] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0284.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.655] lstrlenW (lpString=".dbf") returned 4 [0284.655] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0284.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.655] lstrlenW (lpString=".1cd") returned 4 [0284.655] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0284.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.655] lstrlenW (lpString=".jpg") returned 4 [0284.655] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0284.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.655] lstrlenW (lpString=".doc") returned 4 [0284.655] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0284.655] lstrlenW (lpString=".docx") returned 5 [0284.655] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0284.655] lstrlenW (lpString=".pdf") returned 4 [0284.655] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0284.655] lstrlenW (lpString=".xls") returned 4 [0284.655] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0284.655] lstrlenW (lpString=".xlsx") returned 5 [0284.655] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0284.656] lstrlenW (lpString=".ppt") returned 4 [0284.656] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0284.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.656] lstrlenW (lpString=".zip") returned 4 [0284.656] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0284.656] lstrlenW (lpString=".rar") returned 4 [0284.656] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0284.656] lstrlenW (lpString=".bz2") returned 4 [0284.656] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0284.656] lstrlenW (lpString=".7z") returned 3 [0284.656] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0284.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.656] lstrlenW (lpString=".dbf") returned 4 [0284.656] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0284.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.656] lstrlenW (lpString=".1cd") returned 4 [0284.656] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0284.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0284.656] lstrlenW (lpString=".jpg") returned 4 [0284.656] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0284.656] lstrcmpiW (lpString1=".xsl", lpString2=".drweb") returned 1 [0284.657] lstrlenW (lpString="sql70.xsl") returned 9 [0284.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0285.152] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=32146) returned 1 [0285.152] CloseHandle (hObject=0x218) returned 1 [0285.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0285.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0285.153] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.153] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0285.153] GetLastError () returned 0x0 [0285.153] ReadFile (in: hFile=0x218, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0285.217] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0285.219] ReadFile (in: hFile=0x218, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.219] WriteFile (in: hFile=0x208, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0285.220] SetEndOfFile (hFile=0x208) returned 1 [0285.220] CloseHandle (hObject=0x208) returned 1 [0285.220] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.220] SetEndOfFile (hFile=0x218) returned 1 [0285.221] CloseHandle (hObject=0x218) returned 1 [0285.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0285.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0285.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0285.222] lstrlenW (lpString=".doc") returned 4 [0285.222] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString=".docx") returned 5 [0285.222] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0285.222] lstrlenW (lpString=".pdf") returned 4 [0285.222] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString=".xls") returned 4 [0285.222] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString=".xlsx") returned 5 [0285.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0285.222] lstrlenW (lpString=".ppt") returned 4 [0285.222] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0285.222] lstrlenW (lpString=".zip") returned 4 [0285.222] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0285.222] lstrlenW (lpString=".rar") returned 4 [0285.222] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString=".bz2") returned 4 [0285.222] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString=".7z") returned 3 [0285.222] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0285.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0285.222] lstrlenW (lpString=".dbf") returned 4 [0285.222] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0285.222] lstrlenW (lpString=".1cd") returned 4 [0285.222] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0285.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0285.222] lstrlenW (lpString=".jpg") returned 4 [0285.222] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0285.498] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.498] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0285.498] GetLastError () returned 0x0 [0285.498] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0285.776] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0285.844] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.844] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.844] SetEndOfFile (hFile=0x1f0) returned 1 [0285.844] CloseHandle (hObject=0x1f0) returned 1 [0285.845] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.845] SetEndOfFile (hFile=0x1c8) returned 1 [0285.846] CloseHandle (hObject=0x1c8) returned 1 [0285.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0285.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0285.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0285.847] lstrlenW (lpString=".doc") returned 4 [0285.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0285.847] lstrlenW (lpString=".docx") returned 5 [0285.847] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0285.847] lstrlenW (lpString=".pdf") returned 4 [0285.847] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0285.847] lstrlenW (lpString=".xls") returned 4 [0285.847] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0285.847] lstrlenW (lpString=".xlsx") returned 5 [0285.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0285.847] lstrlenW (lpString=".ppt") returned 4 [0285.847] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0285.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0285.847] lstrlenW (lpString=".zip") returned 4 [0285.847] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0285.847] lstrlenW (lpString=".rar") returned 4 [0285.847] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0285.847] lstrlenW (lpString=".bz2") returned 4 [0285.847] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0285.847] lstrlenW (lpString=".7z") returned 3 [0285.847] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0285.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0285.847] lstrlenW (lpString=".dbf") returned 4 [0285.847] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0285.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0285.847] lstrlenW (lpString=".1cd") returned 4 [0285.847] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0285.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0285.848] lstrlenW (lpString=".jpg") returned 4 [0285.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0285.848] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.848] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0285.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0285.848] GetLastError () returned 0x0 [0285.848] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0285.972] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0285.973] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0285.973] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.973] SetEndOfFile (hFile=0x1f0) returned 1 [0286.539] CloseHandle (hObject=0x1f0) returned 1 [0286.540] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.540] SetEndOfFile (hFile=0x1c8) returned 1 [0286.541] CloseHandle (hObject=0x1c8) returned 1 [0286.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0286.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0286.542] lstrlenW (lpString=".doc") returned 4 [0286.542] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.542] lstrlenW (lpString=".docx") returned 5 [0286.542] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.542] lstrlenW (lpString=".pdf") returned 4 [0286.542] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.542] lstrlenW (lpString=".xls") returned 4 [0286.542] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.542] lstrlenW (lpString=".xlsx") returned 5 [0286.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.542] lstrlenW (lpString=".ppt") returned 4 [0286.542] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0286.542] lstrlenW (lpString=".zip") returned 4 [0286.542] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.542] lstrlenW (lpString=".rar") returned 4 [0286.542] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.542] lstrlenW (lpString=".bz2") returned 4 [0286.542] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.542] lstrlenW (lpString=".7z") returned 3 [0286.542] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0286.543] lstrlenW (lpString=".dbf") returned 4 [0286.543] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0286.543] lstrlenW (lpString=".1cd") returned 4 [0286.543] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0286.543] lstrlenW (lpString=".jpg") returned 4 [0286.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.543] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.543] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0286.544] GetLastError () returned 0x0 [0286.544] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xc44, lpOverlapped=0x0) returned 1 [0286.569] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0286.570] ReadFile (in: hFile=0x1c8, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.570] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.570] SetEndOfFile (hFile=0x1f0) returned 1 [0286.570] CloseHandle (hObject=0x1f0) returned 1 [0286.571] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.571] SetEndOfFile (hFile=0x1c8) returned 1 [0286.571] CloseHandle (hObject=0x1c8) returned 1 [0286.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0286.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0286.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0286.572] lstrlenW (lpString=".doc") returned 4 [0286.572] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.572] lstrlenW (lpString=".docx") returned 5 [0286.572] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.572] lstrlenW (lpString=".pdf") returned 4 [0286.572] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.572] lstrlenW (lpString=".xls") returned 4 [0286.572] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.572] lstrlenW (lpString=".xlsx") returned 5 [0286.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.572] lstrlenW (lpString=".ppt") returned 4 [0286.572] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0286.572] lstrlenW (lpString=".zip") returned 4 [0286.572] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.572] lstrlenW (lpString=".rar") returned 4 [0286.573] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.573] lstrlenW (lpString=".bz2") returned 4 [0286.573] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.573] lstrlenW (lpString=".7z") returned 3 [0286.573] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0286.573] lstrlenW (lpString=".dbf") returned 4 [0286.573] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0286.573] lstrlenW (lpString=".1cd") returned 4 [0286.573] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0286.573] lstrlenW (lpString=".jpg") returned 4 [0286.573] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.588] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.588] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0286.588] GetLastError () returned 0x0 [0286.588] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0xa24, lpOverlapped=0x0) returned 1 [0286.619] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0286.620] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.620] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.620] SetEndOfFile (hFile=0x1f4) returned 1 [0286.620] CloseHandle (hObject=0x1f4) returned 1 [0286.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.621] SetEndOfFile (hFile=0x180) returned 1 [0286.621] CloseHandle (hObject=0x180) returned 1 [0286.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0286.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0286.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0286.622] lstrlenW (lpString=".doc") returned 4 [0286.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.622] lstrlenW (lpString=".docx") returned 5 [0286.622] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.623] lstrlenW (lpString=".pdf") returned 4 [0286.623] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.623] lstrlenW (lpString=".xls") returned 4 [0286.623] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.623] lstrlenW (lpString=".xlsx") returned 5 [0286.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.623] lstrlenW (lpString=".ppt") returned 4 [0286.623] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0286.623] lstrlenW (lpString=".zip") returned 4 [0286.623] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.623] lstrlenW (lpString=".rar") returned 4 [0286.623] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.623] lstrlenW (lpString=".bz2") returned 4 [0286.623] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.623] lstrlenW (lpString=".7z") returned 3 [0286.623] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0286.623] lstrlenW (lpString=".dbf") returned 4 [0286.623] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0286.623] lstrlenW (lpString=".1cd") returned 4 [0286.623] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0286.623] lstrlenW (lpString=".jpg") returned 4 [0286.623] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.624] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.624] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0286.624] GetLastError () returned 0x0 [0286.624] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0286.635] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0286.635] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.635] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.636] SetEndOfFile (hFile=0x1f4) returned 1 [0286.636] CloseHandle (hObject=0x1f4) returned 1 [0286.636] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.636] SetEndOfFile (hFile=0x180) returned 1 [0286.637] CloseHandle (hObject=0x180) returned 1 [0286.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0286.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0286.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0286.637] lstrlenW (lpString=".doc") returned 4 [0286.637] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.637] lstrlenW (lpString=".docx") returned 5 [0286.637] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.637] lstrlenW (lpString=".pdf") returned 4 [0286.637] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.637] lstrlenW (lpString=".xls") returned 4 [0286.637] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.637] lstrlenW (lpString=".xlsx") returned 5 [0286.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.638] lstrlenW (lpString=".ppt") returned 4 [0286.638] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0286.638] lstrlenW (lpString=".zip") returned 4 [0286.638] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.638] lstrlenW (lpString=".rar") returned 4 [0286.638] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.638] lstrlenW (lpString=".bz2") returned 4 [0286.638] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.638] lstrlenW (lpString=".7z") returned 3 [0286.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0286.638] lstrlenW (lpString=".dbf") returned 4 [0286.638] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0286.638] lstrlenW (lpString=".1cd") returned 4 [0286.638] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0286.638] lstrlenW (lpString=".jpg") returned 4 [0286.638] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.638] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.639] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0286.639] GetLastError () returned 0x0 [0286.639] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x135b, lpOverlapped=0x0) returned 1 [0286.666] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0286.667] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.667] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.667] SetEndOfFile (hFile=0x1f4) returned 1 [0286.667] CloseHandle (hObject=0x1f4) returned 1 [0286.667] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.667] SetEndOfFile (hFile=0x180) returned 1 [0286.668] CloseHandle (hObject=0x180) returned 1 [0286.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0286.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0286.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0286.669] lstrlenW (lpString=".doc") returned 4 [0286.669] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0286.669] lstrlenW (lpString=".docx") returned 5 [0286.669] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0286.669] lstrlenW (lpString=".pdf") returned 4 [0286.669] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0286.669] lstrlenW (lpString=".xls") returned 4 [0286.669] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0286.669] lstrlenW (lpString=".xlsx") returned 5 [0286.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0286.669] lstrlenW (lpString=".ppt") returned 4 [0286.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0286.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0286.669] lstrlenW (lpString=".zip") returned 4 [0286.669] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0286.669] lstrlenW (lpString=".rar") returned 4 [0286.669] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0286.669] lstrlenW (lpString=".bz2") returned 4 [0286.669] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0286.669] lstrlenW (lpString=".7z") returned 3 [0286.669] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0286.670] lstrlenW (lpString=".dbf") returned 4 [0286.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0286.670] lstrlenW (lpString=".1cd") returned 4 [0286.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0286.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0286.670] lstrlenW (lpString=".jpg") returned 4 [0286.670] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0286.670] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.670] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0286.670] GetLastError () returned 0x0 [0286.670] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x47a, lpOverlapped=0x0) returned 1 [0286.779] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x480, lpOverlapped=0x0) returned 1 [0286.854] ReadFile (in: hFile=0x180, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0286.854] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0286.855] SetEndOfFile (hFile=0x1f4) returned 1 [0286.855] CloseHandle (hObject=0x1f4) returned 1 [0286.855] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0286.855] SetEndOfFile (hFile=0x180) returned 1 [0286.856] CloseHandle (hObject=0x180) returned 1 [0286.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0286.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0287.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0287.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0287.121] lstrlenW (lpString=".doc") returned 4 [0287.121] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.121] lstrlenW (lpString=".docx") returned 5 [0287.121] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.121] lstrlenW (lpString=".pdf") returned 4 [0287.121] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.121] lstrlenW (lpString=".xls") returned 4 [0287.121] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.121] lstrlenW (lpString=".xlsx") returned 5 [0287.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.121] lstrlenW (lpString=".ppt") returned 4 [0287.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0287.122] lstrlenW (lpString=".zip") returned 4 [0287.122] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.122] lstrlenW (lpString=".rar") returned 4 [0287.122] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.122] lstrlenW (lpString=".bz2") returned 4 [0287.122] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.122] lstrlenW (lpString=".7z") returned 3 [0287.122] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0287.122] lstrlenW (lpString=".dbf") returned 4 [0287.122] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0287.122] lstrlenW (lpString=".1cd") returned 4 [0287.122] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0287.122] lstrlenW (lpString=".jpg") returned 4 [0287.122] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.122] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.122] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0287.123] GetLastError () returned 0x0 [0287.123] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0287.130] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0287.131] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.131] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.131] SetEndOfFile (hFile=0x1b0) returned 1 [0287.132] CloseHandle (hObject=0x1b0) returned 1 [0287.132] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.132] SetEndOfFile (hFile=0x1f4) returned 1 [0287.133] CloseHandle (hObject=0x1f4) returned 1 [0287.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0287.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0287.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0287.134] lstrlenW (lpString=".doc") returned 4 [0287.134] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.134] lstrlenW (lpString=".docx") returned 5 [0287.134] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.134] lstrlenW (lpString=".pdf") returned 4 [0287.134] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.134] lstrlenW (lpString=".xls") returned 4 [0287.134] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.134] lstrlenW (lpString=".xlsx") returned 5 [0287.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.134] lstrlenW (lpString=".ppt") returned 4 [0287.134] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0287.134] lstrlenW (lpString=".zip") returned 4 [0287.134] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.134] lstrlenW (lpString=".rar") returned 4 [0287.134] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.134] lstrlenW (lpString=".bz2") returned 4 [0287.134] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.134] lstrlenW (lpString=".7z") returned 3 [0287.134] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0287.135] lstrlenW (lpString=".dbf") returned 4 [0287.135] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0287.135] lstrlenW (lpString=".1cd") returned 4 [0287.135] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0287.135] lstrlenW (lpString=".jpg") returned 4 [0287.135] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0287.136] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.136] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0287.136] GetLastError () returned 0x0 [0287.137] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x2186, lpOverlapped=0x0) returned 1 [0287.172] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0287.173] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0287.173] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0287.173] SetEndOfFile (hFile=0x1b0) returned 1 [0287.174] CloseHandle (hObject=0x1b0) returned 1 [0287.174] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0287.174] SetEndOfFile (hFile=0x1f4) returned 1 [0287.175] CloseHandle (hObject=0x1f4) returned 1 [0287.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0287.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0287.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0287.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0287.176] lstrlenW (lpString=".doc") returned 4 [0287.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0287.176] lstrlenW (lpString=".docx") returned 5 [0287.176] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0287.176] lstrlenW (lpString=".pdf") returned 4 [0287.177] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0287.177] lstrlenW (lpString=".xls") returned 4 [0287.177] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0287.177] lstrlenW (lpString=".xlsx") returned 5 [0287.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0287.177] lstrlenW (lpString=".ppt") returned 4 [0287.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0287.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0287.177] lstrlenW (lpString=".zip") returned 4 [0287.177] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0287.177] lstrlenW (lpString=".rar") returned 4 [0287.177] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0287.177] lstrlenW (lpString=".bz2") returned 4 [0287.177] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0287.177] lstrlenW (lpString=".7z") returned 3 [0287.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0287.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0287.178] lstrlenW (lpString=".dbf") returned 4 [0287.178] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0287.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0287.178] lstrlenW (lpString=".1cd") returned 4 [0287.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0287.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0287.178] lstrlenW (lpString=".jpg") returned 4 [0287.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 Thread: id = 16 os_tid = 0x5dc [0260.799] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x38f06b0 [0260.799] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10000) returned 0x39006b8 [0260.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3305a0 [0260.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x6) returned 0x333260 [0260.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3305b8 [0260.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x100000) returned 0x3dc0020 [0260.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3305d0 [0260.800] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3305d0, Size=0x20) returned 0x35fb00 [0260.800] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x10) returned 0x3305d0 [0260.801] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3305d0, Size=0x20) returned 0x35fad8 [0260.801] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0260.801] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0260.801] Wow64DisableWow64FsRedirection (in: OldValue=0x32cff58 | out: OldValue=0x32cff58*=0x0) returned 1 [0260.801] lstrlenW (lpString="kernel32.dll") returned 12 [0260.801] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fb00 | out: hHeap=0x2e0000) returned 1 [0260.801] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0260.801] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x35fad8 | out: hHeap=0x2e0000) returned 1 [0260.801] Sleep (dwMilliseconds=0x64) [0261.581] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0261.581] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0261.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0261.771] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2506240) returned 1 [0261.771] CloseHandle (hObject=0x180) returned 1 [0261.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0261.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0261.771] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0261.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0261.774] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0261.774] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0261.774] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.807] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0261.807] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0261.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0261.836] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0261.919] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0261.919] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0261.975] SetEndOfFile (hFile=0x180) returned 1 [0261.975] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0261.999] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0261.999] WriteFile (in: hFile=0x180, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.001] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0262.001] WriteFile (in: hFile=0x180, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.070] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0262.071] WriteFile (in: hFile=0x180, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0262.074] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0262.080] CloseHandle (hObject=0x180) returned 1 [0262.741] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0262.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.741] lstrlenW (lpString=".doc") returned 4 [0262.741] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0262.741] lstrlenW (lpString=".docx") returned 5 [0262.741] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0262.741] lstrlenW (lpString=".pdf") returned 4 [0262.741] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0262.741] lstrlenW (lpString=".xls") returned 4 [0262.741] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0262.741] lstrlenW (lpString=".xlsx") returned 5 [0262.741] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0262.741] lstrlenW (lpString=".ppt") returned 4 [0262.741] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0262.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.741] lstrlenW (lpString=".zip") returned 4 [0262.741] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0262.741] lstrlenW (lpString=".rar") returned 4 [0262.741] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0262.741] lstrlenW (lpString=".bz2") returned 4 [0262.741] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0262.741] lstrlenW (lpString=".7z") returned 3 [0262.741] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0262.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.741] lstrlenW (lpString=".dbf") returned 4 [0262.741] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0262.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.741] lstrlenW (lpString=".1cd") returned 4 [0262.742] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0262.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.742] lstrlenW (lpString=".jpg") returned 4 [0262.742] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0262.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.742] lstrlenW (lpString=".doc") returned 4 [0262.742] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0262.742] lstrlenW (lpString=".docx") returned 5 [0262.742] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0262.742] lstrlenW (lpString=".pdf") returned 4 [0262.742] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0262.742] lstrlenW (lpString=".xls") returned 4 [0262.742] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0262.742] lstrlenW (lpString=".xlsx") returned 5 [0262.742] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0262.742] lstrlenW (lpString=".ppt") returned 4 [0262.742] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0262.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.742] lstrlenW (lpString=".zip") returned 4 [0262.742] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0262.742] lstrlenW (lpString=".rar") returned 4 [0262.742] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0262.742] lstrlenW (lpString=".bz2") returned 4 [0262.742] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0262.742] lstrlenW (lpString=".7z") returned 3 [0262.742] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0262.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.742] lstrlenW (lpString=".dbf") returned 4 [0262.743] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0262.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.743] lstrlenW (lpString=".1cd") returned 4 [0262.743] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0262.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0262.743] lstrlenW (lpString=".jpg") returned 4 [0262.743] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0262.743] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0262.743] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0262.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0262.743] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2513920) returned 1 [0262.743] CloseHandle (hObject=0x180) returned 1 [0262.743] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0262.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0262.744] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0262.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0262.744] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0262.744] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0262.744] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.766] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0262.766] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.796] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0262.796] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0262.796] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0262.900] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0262.900] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0262.920] SetEndOfFile (hFile=0x180) returned 1 [0262.921] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f13878 [0262.925] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0262.925] WriteFile (in: hFile=0x180, lpBuffer=0x3f13878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13878*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.121] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0263.122] WriteFile (in: hFile=0x180, lpBuffer=0x3f13878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13878*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.127] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0263.127] WriteFile (in: hFile=0x180, lpBuffer=0x3f13878*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13878*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0263.130] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f13878 | out: hHeap=0x2e0000) returned 1 [0263.130] CloseHandle (hObject=0x180) returned 1 [0263.567] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0263.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.567] lstrlenW (lpString=".doc") returned 4 [0263.567] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0263.567] lstrlenW (lpString=".docx") returned 5 [0263.567] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0263.567] lstrlenW (lpString=".pdf") returned 4 [0263.567] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0263.567] lstrlenW (lpString=".xls") returned 4 [0263.567] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0263.567] lstrlenW (lpString=".xlsx") returned 5 [0263.567] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0263.567] lstrlenW (lpString=".ppt") returned 4 [0263.567] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0263.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.567] lstrlenW (lpString=".zip") returned 4 [0263.567] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0263.567] lstrlenW (lpString=".rar") returned 4 [0263.567] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0263.567] lstrlenW (lpString=".bz2") returned 4 [0263.567] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0263.567] lstrlenW (lpString=".7z") returned 3 [0263.567] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0263.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString=".dbf") returned 4 [0263.568] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString=".1cd") returned 4 [0263.568] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString=".jpg") returned 4 [0263.568] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString=".doc") returned 4 [0263.568] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0263.568] lstrlenW (lpString=".docx") returned 5 [0263.568] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0263.568] lstrlenW (lpString=".pdf") returned 4 [0263.568] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0263.568] lstrlenW (lpString=".xls") returned 4 [0263.568] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0263.568] lstrlenW (lpString=".xlsx") returned 5 [0263.568] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0263.568] lstrlenW (lpString=".ppt") returned 4 [0263.568] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString=".zip") returned 4 [0263.568] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0263.568] lstrlenW (lpString=".rar") returned 4 [0263.568] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0263.568] lstrlenW (lpString=".bz2") returned 4 [0263.568] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0263.568] lstrlenW (lpString=".7z") returned 3 [0263.568] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.568] lstrlenW (lpString=".dbf") returned 4 [0263.568] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0263.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.569] lstrlenW (lpString=".1cd") returned 4 [0263.569] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0263.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0263.569] lstrlenW (lpString=".jpg") returned 4 [0263.569] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0263.569] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0263.569] lstrlenW (lpString="OutlkLR.cab") returned 11 [0263.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0263.570] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=14819276) returned 1 [0263.570] CloseHandle (hObject=0x180) returned 1 [0263.570] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0263.570] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0263.570] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0263.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0263.570] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0263.571] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0263.571] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0263.943] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0263.943] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0263.984] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0263.985] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0263.985] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0264.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0264.065] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0264.077] SetEndOfFile (hFile=0x180) returned 1 [0264.077] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f24888 [0264.081] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0264.081] WriteFile (in: hFile=0x180, lpBuffer=0x3f24888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f24888*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0264.082] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0264.082] WriteFile (in: hFile=0x180, lpBuffer=0x3f24888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f24888*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0264.083] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0264.083] WriteFile (in: hFile=0x180, lpBuffer=0x3f24888*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f24888*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0264.084] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f24888 | out: hHeap=0x2e0000) returned 1 [0264.085] CloseHandle (hObject=0x180) returned 1 [0267.848] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0267.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.848] lstrlenW (lpString=".doc") returned 4 [0267.848] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0267.848] lstrlenW (lpString=".docx") returned 5 [0267.848] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0267.848] lstrlenW (lpString=".pdf") returned 4 [0267.848] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0267.848] lstrlenW (lpString=".xls") returned 4 [0267.848] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0267.848] lstrlenW (lpString=".xlsx") returned 5 [0267.848] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0267.848] lstrlenW (lpString=".ppt") returned 4 [0267.848] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0267.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.848] lstrlenW (lpString=".zip") returned 4 [0267.848] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0267.848] lstrlenW (lpString=".rar") returned 4 [0267.848] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0267.848] lstrlenW (lpString=".bz2") returned 4 [0267.848] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0267.848] lstrlenW (lpString=".7z") returned 3 [0267.848] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString=".dbf") returned 4 [0267.849] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString=".1cd") returned 4 [0267.849] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString=".jpg") returned 4 [0267.849] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString=".doc") returned 4 [0267.849] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString=".docx") returned 5 [0267.849] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0267.849] lstrlenW (lpString=".pdf") returned 4 [0267.849] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString=".xls") returned 4 [0267.849] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString=".xlsx") returned 5 [0267.849] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0267.849] lstrlenW (lpString=".ppt") returned 4 [0267.849] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString=".zip") returned 4 [0267.849] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString=".rar") returned 4 [0267.849] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0267.849] lstrlenW (lpString=".bz2") returned 4 [0267.849] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0267.849] lstrlenW (lpString=".7z") returned 3 [0267.849] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0267.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.849] lstrlenW (lpString=".dbf") returned 4 [0267.850] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0267.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.850] lstrlenW (lpString=".1cd") returned 4 [0267.850] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0267.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0267.850] lstrlenW (lpString=".jpg") returned 4 [0267.850] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0267.850] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0267.850] lstrlenW (lpString="Proof.msi") returned 9 [0267.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0267.850] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=875520) returned 1 [0267.850] CloseHandle (hObject=0x180) returned 1 [0267.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0267.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0267.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0267.851] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0267.851] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0267.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0267.851] GetLastError () returned 0x0 [0267.851] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0268.348] WriteFile (in: hFile=0x164, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0268.362] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0268.362] WriteFile (in: hFile=0x164, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0268.362] SetEndOfFile (hFile=0x164) returned 1 [0268.362] CloseHandle (hObject=0x164) returned 1 [0268.369] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0268.369] SetEndOfFile (hFile=0x180) returned 1 [0268.822] CloseHandle (hObject=0x180) returned 1 [0268.822] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0268.828] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0268.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.846] lstrlenW (lpString=".doc") returned 4 [0268.846] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0268.846] lstrlenW (lpString=".docx") returned 5 [0268.846] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0268.846] lstrlenW (lpString=".pdf") returned 4 [0268.846] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0268.846] lstrlenW (lpString=".xls") returned 4 [0268.846] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0268.846] lstrlenW (lpString=".xlsx") returned 5 [0268.846] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0268.846] lstrlenW (lpString=".ppt") returned 4 [0268.846] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0268.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.846] lstrlenW (lpString=".zip") returned 4 [0268.846] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0268.846] lstrlenW (lpString=".rar") returned 4 [0268.846] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0268.846] lstrlenW (lpString=".bz2") returned 4 [0268.846] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0268.846] lstrlenW (lpString=".7z") returned 3 [0268.846] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0268.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.846] lstrlenW (lpString=".dbf") returned 4 [0268.846] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0268.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.847] lstrlenW (lpString=".1cd") returned 4 [0268.847] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0268.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.847] lstrlenW (lpString=".jpg") returned 4 [0268.847] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0268.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.847] lstrlenW (lpString=".doc") returned 4 [0268.847] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0268.847] lstrlenW (lpString=".docx") returned 5 [0268.847] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0268.847] lstrlenW (lpString=".pdf") returned 4 [0268.847] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0268.847] lstrlenW (lpString=".xls") returned 4 [0268.847] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0268.847] lstrlenW (lpString=".xlsx") returned 5 [0268.847] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0268.847] lstrlenW (lpString=".ppt") returned 4 [0268.847] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0268.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.847] lstrlenW (lpString=".zip") returned 4 [0268.847] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0268.847] lstrlenW (lpString=".rar") returned 4 [0268.847] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0268.847] lstrlenW (lpString=".bz2") returned 4 [0268.847] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0268.847] lstrlenW (lpString=".7z") returned 3 [0268.847] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0268.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.848] lstrlenW (lpString=".dbf") returned 4 [0268.848] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0268.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.848] lstrlenW (lpString=".1cd") returned 4 [0268.848] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0268.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0268.848] lstrlenW (lpString=".jpg") returned 4 [0268.848] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0268.848] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0268.848] lstrlenW (lpString="Proof.msi") returned 9 [0268.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0268.848] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=881152) returned 1 [0268.848] CloseHandle (hObject=0x180) returned 1 [0268.849] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0268.849] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0268.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0268.849] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0268.849] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0268.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0268.849] GetLastError () returned 0x0 [0268.849] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0xd7200, lpOverlapped=0x0) returned 1 [0268.948] WriteFile (in: hFile=0x1e8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0269.189] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0269.189] WriteFile (in: hFile=0x1e8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0269.281] SetEndOfFile (hFile=0x1e8) returned 1 [0269.287] CloseHandle (hObject=0x1e8) returned 1 [0269.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0269.299] SetEndOfFile (hFile=0x180) returned 1 [0269.314] CloseHandle (hObject=0x180) returned 1 [0269.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0269.314] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0269.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.315] lstrlenW (lpString=".doc") returned 4 [0269.315] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0269.315] lstrlenW (lpString=".docx") returned 5 [0269.315] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0269.315] lstrlenW (lpString=".pdf") returned 4 [0269.315] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0269.315] lstrlenW (lpString=".xls") returned 4 [0269.315] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0269.315] lstrlenW (lpString=".xlsx") returned 5 [0269.315] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0269.315] lstrlenW (lpString=".ppt") returned 4 [0269.315] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0269.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.315] lstrlenW (lpString=".zip") returned 4 [0269.315] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0269.315] lstrlenW (lpString=".rar") returned 4 [0269.315] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0269.315] lstrlenW (lpString=".bz2") returned 4 [0269.315] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0269.315] lstrlenW (lpString=".7z") returned 3 [0269.315] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0269.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.315] lstrlenW (lpString=".dbf") returned 4 [0269.315] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0269.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.315] lstrlenW (lpString=".1cd") returned 4 [0269.316] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0269.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.316] lstrlenW (lpString=".jpg") returned 4 [0269.316] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0269.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.316] lstrlenW (lpString=".doc") returned 4 [0269.316] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0269.316] lstrlenW (lpString=".docx") returned 5 [0269.316] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0269.316] lstrlenW (lpString=".pdf") returned 4 [0269.316] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0269.316] lstrlenW (lpString=".xls") returned 4 [0269.316] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0269.316] lstrlenW (lpString=".xlsx") returned 5 [0269.316] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0269.316] lstrlenW (lpString=".ppt") returned 4 [0269.316] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0269.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.316] lstrlenW (lpString=".zip") returned 4 [0269.316] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0269.316] lstrlenW (lpString=".rar") returned 4 [0269.316] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0269.316] lstrlenW (lpString=".bz2") returned 4 [0269.316] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0269.316] lstrlenW (lpString=".7z") returned 3 [0269.316] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0269.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.317] lstrlenW (lpString=".dbf") returned 4 [0269.317] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0269.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.317] lstrlenW (lpString=".1cd") returned 4 [0269.317] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0269.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0269.317] lstrlenW (lpString=".jpg") returned 4 [0269.317] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0269.317] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0269.317] lstrlenW (lpString="Proof.cab") returned 9 [0269.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0269.318] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=21064532) returned 1 [0269.318] CloseHandle (hObject=0x180) returned 1 [0269.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0269.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0269.318] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0269.848] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0269.848] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0269.848] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0269.848] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0269.968] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0269.968] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0270.026] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0270.026] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0270.026] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0270.210] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0270.210] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0270.221] SetEndOfFile (hFile=0x180) returned 1 [0270.221] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0270.225] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0270.225] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0270.226] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0270.226] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0270.227] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0270.227] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0270.228] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0270.228] CloseHandle (hObject=0x180) returned 1 [0271.760] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0271.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.769] lstrlenW (lpString=".doc") returned 4 [0271.769] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0271.769] lstrlenW (lpString=".docx") returned 5 [0271.769] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0271.769] lstrlenW (lpString=".pdf") returned 4 [0271.769] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0271.769] lstrlenW (lpString=".xls") returned 4 [0271.769] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0271.769] lstrlenW (lpString=".xlsx") returned 5 [0271.769] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0271.769] lstrlenW (lpString=".ppt") returned 4 [0271.769] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0271.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.770] lstrlenW (lpString=".zip") returned 4 [0271.770] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString=".rar") returned 4 [0271.770] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString=".bz2") returned 4 [0271.770] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0271.770] lstrlenW (lpString=".7z") returned 3 [0271.770] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0271.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.770] lstrlenW (lpString=".dbf") returned 4 [0271.770] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.770] lstrlenW (lpString=".1cd") returned 4 [0271.770] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0271.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.770] lstrlenW (lpString=".jpg") returned 4 [0271.770] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.770] lstrlenW (lpString=".doc") returned 4 [0271.770] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString=".docx") returned 5 [0271.770] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0271.770] lstrlenW (lpString=".pdf") returned 4 [0271.770] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString=".xls") returned 4 [0271.770] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0271.770] lstrlenW (lpString=".xlsx") returned 5 [0271.770] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0271.771] lstrlenW (lpString=".ppt") returned 4 [0271.771] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0271.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.771] lstrlenW (lpString=".zip") returned 4 [0271.771] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0271.771] lstrlenW (lpString=".rar") returned 4 [0271.771] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0271.771] lstrlenW (lpString=".bz2") returned 4 [0271.771] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0271.771] lstrlenW (lpString=".7z") returned 3 [0271.771] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0271.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.771] lstrlenW (lpString=".dbf") returned 4 [0271.771] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0271.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.771] lstrlenW (lpString=".1cd") returned 4 [0271.771] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0271.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0271.771] lstrlenW (lpString=".jpg") returned 4 [0271.771] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0271.771] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0271.771] lstrlenW (lpString="VisioMUI.msi") returned 12 [0271.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0271.772] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2797568) returned 1 [0271.772] CloseHandle (hObject=0x180) returned 1 [0271.772] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0271.772] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0271.772] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0271.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0271.773] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0271.773] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0271.773] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0273.016] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0273.016] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0273.350] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0273.350] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0273.350] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0273.837] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0273.837] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0273.885] SetEndOfFile (hFile=0x180) returned 1 [0273.886] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0273.886] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0273.886] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0273.887] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0273.887] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0273.893] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0273.893] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0273.896] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0273.896] CloseHandle (hObject=0x180) returned 1 [0273.896] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0273.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.896] lstrlenW (lpString=".doc") returned 4 [0273.896] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0273.897] lstrlenW (lpString=".docx") returned 5 [0273.897] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0273.897] lstrlenW (lpString=".pdf") returned 4 [0273.897] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0273.897] lstrlenW (lpString=".xls") returned 4 [0273.897] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0273.897] lstrlenW (lpString=".xlsx") returned 5 [0273.897] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0273.897] lstrlenW (lpString=".ppt") returned 4 [0273.897] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0273.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.897] lstrlenW (lpString=".zip") returned 4 [0273.897] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0273.897] lstrlenW (lpString=".rar") returned 4 [0273.897] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0273.897] lstrlenW (lpString=".bz2") returned 4 [0273.897] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0273.897] lstrlenW (lpString=".7z") returned 3 [0273.897] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0273.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.897] lstrlenW (lpString=".dbf") returned 4 [0273.897] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0273.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.897] lstrlenW (lpString=".1cd") returned 4 [0273.897] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0273.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.898] lstrlenW (lpString=".jpg") returned 4 [0273.898] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0273.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.898] lstrlenW (lpString=".doc") returned 4 [0273.898] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0273.898] lstrlenW (lpString=".docx") returned 5 [0273.898] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0273.898] lstrlenW (lpString=".pdf") returned 4 [0273.898] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0273.898] lstrlenW (lpString=".xls") returned 4 [0273.898] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0273.898] lstrlenW (lpString=".xlsx") returned 5 [0273.898] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0273.898] lstrlenW (lpString=".ppt") returned 4 [0273.898] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0273.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.898] lstrlenW (lpString=".zip") returned 4 [0273.898] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0273.898] lstrlenW (lpString=".rar") returned 4 [0273.898] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0273.898] lstrlenW (lpString=".bz2") returned 4 [0273.898] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0273.898] lstrlenW (lpString=".7z") returned 3 [0273.898] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0273.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.899] lstrlenW (lpString=".dbf") returned 4 [0273.899] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0273.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.899] lstrlenW (lpString=".1cd") returned 4 [0273.899] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0273.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0273.899] lstrlenW (lpString=".jpg") returned 4 [0273.899] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0273.899] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0273.899] lstrlenW (lpString="GrooveLR.cab") returned 12 [0273.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0273.900] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=4095519) returned 1 [0273.900] CloseHandle (hObject=0x180) returned 1 [0273.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0273.900] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0273.900] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0273.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0273.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0273.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0273.901] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0274.311] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0274.312] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0274.503] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0274.503] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0274.503] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0274.842] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0274.842] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0274.876] SetEndOfFile (hFile=0x180) returned 1 [0274.876] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0274.876] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0274.876] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0274.878] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0274.878] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0274.880] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0274.880] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0274.882] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0274.882] CloseHandle (hObject=0x180) returned 1 [0274.882] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0274.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.883] lstrlenW (lpString=".doc") returned 4 [0274.883] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString=".docx") returned 5 [0274.883] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0274.883] lstrlenW (lpString=".pdf") returned 4 [0274.883] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString=".xls") returned 4 [0274.883] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString=".xlsx") returned 5 [0274.883] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0274.883] lstrlenW (lpString=".ppt") returned 4 [0274.883] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.883] lstrlenW (lpString=".zip") returned 4 [0274.883] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString=".rar") returned 4 [0274.883] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString=".bz2") returned 4 [0274.883] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0274.883] lstrlenW (lpString=".7z") returned 3 [0274.883] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0274.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.883] lstrlenW (lpString=".dbf") returned 4 [0274.883] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0274.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.883] lstrlenW (lpString=".1cd") returned 4 [0274.883] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0274.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.883] lstrlenW (lpString=".jpg") returned 4 [0274.883] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.884] lstrlenW (lpString=".doc") returned 4 [0274.884] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString=".docx") returned 5 [0274.884] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0274.884] lstrlenW (lpString=".pdf") returned 4 [0274.884] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString=".xls") returned 4 [0274.884] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString=".xlsx") returned 5 [0274.884] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0274.884] lstrlenW (lpString=".ppt") returned 4 [0274.884] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.884] lstrlenW (lpString=".zip") returned 4 [0274.884] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString=".rar") returned 4 [0274.884] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString=".bz2") returned 4 [0274.884] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0274.884] lstrlenW (lpString=".7z") returned 3 [0274.884] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0274.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.884] lstrlenW (lpString=".dbf") returned 4 [0274.884] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0274.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.884] lstrlenW (lpString=".1cd") returned 4 [0274.884] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0274.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0274.884] lstrlenW (lpString=".jpg") returned 4 [0274.884] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0274.885] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0274.885] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0274.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0274.885] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2507776) returned 1 [0274.885] CloseHandle (hObject=0x180) returned 1 [0274.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0274.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0274.885] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0274.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0274.886] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0274.886] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0274.886] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0274.965] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0274.965] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0275.152] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0275.152] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0275.152] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0275.274] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.274] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0275.294] SetEndOfFile (hFile=0x180) returned 1 [0275.301] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0275.301] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0275.301] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0275.303] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0275.303] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0275.312] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0275.312] WriteFile (in: hFile=0x180, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0275.316] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0275.316] CloseHandle (hObject=0x180) returned 1 [0275.316] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0275.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.316] lstrlenW (lpString=".doc") returned 4 [0275.316] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0275.316] lstrlenW (lpString=".docx") returned 5 [0275.316] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0275.316] lstrlenW (lpString=".pdf") returned 4 [0275.316] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0275.316] lstrlenW (lpString=".xls") returned 4 [0275.317] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0275.317] lstrlenW (lpString=".xlsx") returned 5 [0275.317] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0275.317] lstrlenW (lpString=".ppt") returned 4 [0275.317] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0275.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.317] lstrlenW (lpString=".zip") returned 4 [0275.317] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0275.317] lstrlenW (lpString=".rar") returned 4 [0275.317] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0275.317] lstrlenW (lpString=".bz2") returned 4 [0275.317] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0275.317] lstrlenW (lpString=".7z") returned 3 [0275.317] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0275.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.317] lstrlenW (lpString=".dbf") returned 4 [0275.317] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0275.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.317] lstrlenW (lpString=".1cd") returned 4 [0275.317] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0275.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.317] lstrlenW (lpString=".jpg") returned 4 [0275.317] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0275.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.317] lstrlenW (lpString=".doc") returned 4 [0275.317] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0275.317] lstrlenW (lpString=".docx") returned 5 [0275.317] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0275.318] lstrlenW (lpString=".pdf") returned 4 [0275.318] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0275.318] lstrlenW (lpString=".xls") returned 4 [0275.318] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0275.318] lstrlenW (lpString=".xlsx") returned 5 [0275.318] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0275.318] lstrlenW (lpString=".ppt") returned 4 [0275.318] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0275.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.318] lstrlenW (lpString=".zip") returned 4 [0275.318] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0275.318] lstrlenW (lpString=".rar") returned 4 [0275.318] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0275.318] lstrlenW (lpString=".bz2") returned 4 [0275.318] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0275.318] lstrlenW (lpString=".7z") returned 3 [0275.318] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0275.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.318] lstrlenW (lpString=".dbf") returned 4 [0275.318] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0275.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.318] lstrlenW (lpString=".1cd") returned 4 [0275.318] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0275.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0275.318] lstrlenW (lpString=".jpg") returned 4 [0275.318] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0275.319] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0275.319] lstrlenW (lpString="dwintl20.dll") returned 12 [0275.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0275.319] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=107912) returned 1 [0275.319] CloseHandle (hObject=0x180) returned 1 [0275.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0275.319] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0275.320] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.320] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0275.321] GetLastError () returned 0x0 [0275.321] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x1a588, lpOverlapped=0x0) returned 1 [0275.356] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0275.360] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0275.361] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.361] SetEndOfFile (hFile=0x1b0) returned 1 [0275.361] CloseHandle (hObject=0x1b0) returned 1 [0275.361] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.361] SetEndOfFile (hFile=0x180) returned 1 [0275.362] CloseHandle (hObject=0x180) returned 1 [0275.363] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0275.363] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0275.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.363] lstrlenW (lpString=".doc") returned 4 [0275.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0275.363] lstrlenW (lpString=".docx") returned 5 [0275.363] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0275.363] lstrlenW (lpString=".pdf") returned 4 [0275.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0275.363] lstrlenW (lpString=".xls") returned 4 [0275.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0275.363] lstrlenW (lpString=".xlsx") returned 5 [0275.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0275.364] lstrlenW (lpString=".ppt") returned 4 [0275.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0275.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.364] lstrlenW (lpString=".zip") returned 4 [0275.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0275.364] lstrlenW (lpString=".rar") returned 4 [0275.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0275.364] lstrlenW (lpString=".bz2") returned 4 [0275.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0275.364] lstrlenW (lpString=".7z") returned 3 [0275.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0275.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.364] lstrlenW (lpString=".dbf") returned 4 [0275.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0275.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.364] lstrlenW (lpString=".1cd") returned 4 [0275.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0275.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.364] lstrlenW (lpString=".jpg") returned 4 [0275.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0275.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.364] lstrlenW (lpString=".doc") returned 4 [0275.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0275.364] lstrlenW (lpString=".docx") returned 5 [0275.364] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0275.365] lstrlenW (lpString=".pdf") returned 4 [0275.365] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0275.365] lstrlenW (lpString=".xls") returned 4 [0275.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0275.365] lstrlenW (lpString=".xlsx") returned 5 [0275.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0275.365] lstrlenW (lpString=".ppt") returned 4 [0275.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0275.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.365] lstrlenW (lpString=".zip") returned 4 [0275.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0275.365] lstrlenW (lpString=".rar") returned 4 [0275.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0275.365] lstrlenW (lpString=".bz2") returned 4 [0275.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0275.365] lstrlenW (lpString=".7z") returned 3 [0275.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0275.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.365] lstrlenW (lpString=".dbf") returned 4 [0275.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0275.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.365] lstrlenW (lpString=".1cd") returned 4 [0275.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0275.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0275.365] lstrlenW (lpString=".jpg") returned 4 [0275.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0275.366] lstrcmpiW (lpString1=".EXE", lpString2=".drweb") returned 1 [0275.366] lstrlenW (lpString="DW20.EXE") returned 8 [0275.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0275.391] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=838536) returned 1 [0275.391] CloseHandle (hObject=0x1b0) returned 1 [0275.391] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0275.391] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0275.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0275.392] GetLastError () returned 0x0 [0275.392] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0275.719] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0275.733] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0275.733] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0275.734] SetEndOfFile (hFile=0x174) returned 1 [0275.734] CloseHandle (hObject=0x174) returned 1 [0275.735] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.735] SetEndOfFile (hFile=0x1b0) returned 1 [0275.743] CloseHandle (hObject=0x1b0) returned 1 [0275.743] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0275.744] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0275.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.744] lstrlenW (lpString=".doc") returned 4 [0275.744] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0275.744] lstrlenW (lpString=".docx") returned 5 [0275.744] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0275.744] lstrlenW (lpString=".pdf") returned 4 [0275.744] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0275.744] lstrlenW (lpString=".xls") returned 4 [0275.744] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0275.744] lstrlenW (lpString=".xlsx") returned 5 [0275.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0275.744] lstrlenW (lpString=".ppt") returned 4 [0275.744] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0275.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.744] lstrlenW (lpString=".zip") returned 4 [0275.744] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0275.744] lstrlenW (lpString=".rar") returned 4 [0275.745] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0275.745] lstrlenW (lpString=".bz2") returned 4 [0275.745] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0275.745] lstrlenW (lpString=".7z") returned 3 [0275.745] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0275.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.745] lstrlenW (lpString=".dbf") returned 4 [0275.745] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0275.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.745] lstrlenW (lpString=".1cd") returned 4 [0275.745] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0275.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.745] lstrlenW (lpString=".jpg") returned 4 [0275.745] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0275.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.745] lstrlenW (lpString=".doc") returned 4 [0275.745] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0275.745] lstrlenW (lpString=".docx") returned 5 [0275.745] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0275.745] lstrlenW (lpString=".pdf") returned 4 [0275.745] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0275.745] lstrlenW (lpString=".xls") returned 4 [0275.745] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0275.745] lstrlenW (lpString=".xlsx") returned 5 [0275.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0275.746] lstrlenW (lpString=".ppt") returned 4 [0275.746] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0275.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.746] lstrlenW (lpString=".zip") returned 4 [0275.746] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0275.746] lstrlenW (lpString=".rar") returned 4 [0275.746] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0275.746] lstrlenW (lpString=".bz2") returned 4 [0275.746] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0275.746] lstrlenW (lpString=".7z") returned 3 [0275.746] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0275.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.746] lstrlenW (lpString=".dbf") returned 4 [0275.746] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0275.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.746] lstrlenW (lpString=".1cd") returned 4 [0275.746] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0275.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0275.746] lstrlenW (lpString=".jpg") returned 4 [0275.746] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0275.746] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0275.746] lstrlenW (lpString="dwdcw20.dll") returned 11 [0275.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0275.747] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=526176) returned 1 [0275.747] CloseHandle (hObject=0x1b0) returned 1 [0275.747] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0275.747] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0275.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0275.748] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.748] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0275.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0275.748] GetLastError () returned 0x0 [0275.748] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x80760, lpOverlapped=0x0) returned 1 [0276.465] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x80770, lpOverlapped=0x0) returned 1 [0276.476] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0276.477] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0276.477] SetEndOfFile (hFile=0x174) returned 1 [0276.477] CloseHandle (hObject=0x174) returned 1 [0276.477] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.477] SetEndOfFile (hFile=0x1b0) returned 1 [0276.483] CloseHandle (hObject=0x1b0) returned 1 [0276.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0276.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0276.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.483] lstrlenW (lpString=".doc") returned 4 [0276.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0276.483] lstrlenW (lpString=".docx") returned 5 [0276.484] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0276.484] lstrlenW (lpString=".pdf") returned 4 [0276.484] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0276.484] lstrlenW (lpString=".xls") returned 4 [0276.484] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0276.484] lstrlenW (lpString=".xlsx") returned 5 [0276.484] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0276.484] lstrlenW (lpString=".ppt") returned 4 [0276.484] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0276.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.484] lstrlenW (lpString=".zip") returned 4 [0276.484] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0276.484] lstrlenW (lpString=".rar") returned 4 [0276.484] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0276.484] lstrlenW (lpString=".bz2") returned 4 [0276.484] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0276.484] lstrlenW (lpString=".7z") returned 3 [0276.484] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0276.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.484] lstrlenW (lpString=".dbf") returned 4 [0276.484] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0276.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.484] lstrlenW (lpString=".1cd") returned 4 [0276.484] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0276.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.484] lstrlenW (lpString=".jpg") returned 4 [0276.484] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0276.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.485] lstrlenW (lpString=".doc") returned 4 [0276.485] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0276.485] lstrlenW (lpString=".docx") returned 5 [0276.485] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0276.485] lstrlenW (lpString=".pdf") returned 4 [0276.485] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0276.485] lstrlenW (lpString=".xls") returned 4 [0276.485] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0276.485] lstrlenW (lpString=".xlsx") returned 5 [0276.485] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0276.485] lstrlenW (lpString=".ppt") returned 4 [0276.485] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0276.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.485] lstrlenW (lpString=".zip") returned 4 [0276.485] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0276.485] lstrlenW (lpString=".rar") returned 4 [0276.485] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0276.485] lstrlenW (lpString=".bz2") returned 4 [0276.485] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0276.485] lstrlenW (lpString=".7z") returned 3 [0276.485] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0276.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.485] lstrlenW (lpString=".dbf") returned 4 [0276.485] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0276.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.485] lstrlenW (lpString=".1cd") returned 4 [0276.485] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0276.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0276.486] lstrlenW (lpString=".jpg") returned 4 [0276.486] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0276.486] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0276.486] lstrlenW (lpString="dwtrig20.exe") returned 12 [0276.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0276.486] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=519584) returned 1 [0276.486] CloseHandle (hObject=0x1b0) returned 1 [0276.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0276.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0276.487] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.487] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0276.487] GetLastError () returned 0x0 [0276.487] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0276.569] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0276.579] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0276.579] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0276.579] SetEndOfFile (hFile=0x174) returned 1 [0276.579] CloseHandle (hObject=0x174) returned 1 [0276.579] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.579] SetEndOfFile (hFile=0x1b0) returned 1 [0276.584] CloseHandle (hObject=0x1b0) returned 1 [0276.584] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0276.584] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0276.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.585] lstrlenW (lpString=".doc") returned 4 [0276.585] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0276.585] lstrlenW (lpString=".docx") returned 5 [0276.585] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0276.585] lstrlenW (lpString=".pdf") returned 4 [0276.585] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0276.585] lstrlenW (lpString=".xls") returned 4 [0276.585] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0276.585] lstrlenW (lpString=".xlsx") returned 5 [0276.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0276.585] lstrlenW (lpString=".ppt") returned 4 [0276.585] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0276.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.585] lstrlenW (lpString=".zip") returned 4 [0276.585] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0276.585] lstrlenW (lpString=".rar") returned 4 [0276.585] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0276.585] lstrlenW (lpString=".bz2") returned 4 [0276.585] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0276.585] lstrlenW (lpString=".7z") returned 3 [0276.585] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0276.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.586] lstrlenW (lpString=".dbf") returned 4 [0276.586] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0276.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.586] lstrlenW (lpString=".1cd") returned 4 [0276.586] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0276.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.586] lstrlenW (lpString=".jpg") returned 4 [0276.586] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0276.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.586] lstrlenW (lpString=".doc") returned 4 [0276.586] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0276.586] lstrlenW (lpString=".docx") returned 5 [0276.586] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0276.586] lstrlenW (lpString=".pdf") returned 4 [0276.586] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0276.586] lstrlenW (lpString=".xls") returned 4 [0276.586] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0276.586] lstrlenW (lpString=".xlsx") returned 5 [0276.586] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0276.586] lstrlenW (lpString=".ppt") returned 4 [0276.586] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0276.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.586] lstrlenW (lpString=".zip") returned 4 [0276.586] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0276.586] lstrlenW (lpString=".rar") returned 4 [0276.586] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0276.587] lstrlenW (lpString=".bz2") returned 4 [0276.587] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0276.587] lstrlenW (lpString=".7z") returned 3 [0276.587] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0276.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.587] lstrlenW (lpString=".dbf") returned 4 [0276.587] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0276.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.587] lstrlenW (lpString=".1cd") returned 4 [0276.587] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0276.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0276.587] lstrlenW (lpString=".jpg") returned 4 [0276.587] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0276.587] lstrcmpiW (lpString1=".manifest", lpString2=".drweb") returned 1 [0276.587] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0276.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0276.588] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1857) returned 1 [0276.588] CloseHandle (hObject=0x1b0) returned 1 [0276.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0276.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0276.588] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.588] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0276.590] GetLastError () returned 0x0 [0276.590] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x741, lpOverlapped=0x0) returned 1 [0276.696] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x750, lpOverlapped=0x0) returned 1 [0276.699] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0276.699] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x10a, lpOverlapped=0x0) returned 1 [0276.699] SetEndOfFile (hFile=0x174) returned 1 [0276.699] CloseHandle (hObject=0x174) returned 1 [0276.699] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.699] SetEndOfFile (hFile=0x1b0) returned 1 [0276.700] CloseHandle (hObject=0x1b0) returned 1 [0276.701] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0276.701] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0276.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.701] lstrlenW (lpString=".doc") returned 4 [0276.701] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0276.701] lstrlenW (lpString=".docx") returned 5 [0276.701] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0276.701] lstrlenW (lpString=".pdf") returned 4 [0276.701] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0276.701] lstrlenW (lpString=".xls") returned 4 [0276.702] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString=".xlsx") returned 5 [0276.702] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0276.702] lstrlenW (lpString=".ppt") returned 4 [0276.702] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.702] lstrlenW (lpString=".zip") returned 4 [0276.702] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString=".rar") returned 4 [0276.702] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString=".bz2") returned 4 [0276.702] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString=".7z") returned 3 [0276.702] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0276.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.702] lstrlenW (lpString=".dbf") returned 4 [0276.702] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.702] lstrlenW (lpString=".1cd") returned 4 [0276.702] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.702] lstrlenW (lpString=".jpg") returned 4 [0276.702] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.702] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.702] lstrlenW (lpString=".doc") returned 4 [0276.702] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0276.702] lstrlenW (lpString=".docx") returned 5 [0276.702] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0276.702] lstrlenW (lpString=".pdf") returned 4 [0276.703] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString=".xls") returned 4 [0276.703] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString=".xlsx") returned 5 [0276.703] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0276.703] lstrlenW (lpString=".ppt") returned 4 [0276.703] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.703] lstrlenW (lpString=".zip") returned 4 [0276.703] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString=".rar") returned 4 [0276.703] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString=".bz2") returned 4 [0276.703] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString=".7z") returned 3 [0276.703] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0276.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.703] lstrlenW (lpString=".dbf") returned 4 [0276.703] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.703] lstrlenW (lpString=".1cd") returned 4 [0276.703] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0276.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0276.703] lstrlenW (lpString=".jpg") returned 4 [0276.703] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0276.704] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0276.704] lstrlenW (lpString="msvcr90.dll") returned 11 [0276.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0276.704] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=655872) returned 1 [0276.704] CloseHandle (hObject=0x1b0) returned 1 [0276.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0276.704] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0276.704] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0276.704] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.704] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0276.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0276.705] GetLastError () returned 0x0 [0276.705] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0277.700] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0277.986] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0277.987] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0277.987] SetEndOfFile (hFile=0x174) returned 1 [0277.987] CloseHandle (hObject=0x174) returned 1 [0277.987] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0277.987] SetEndOfFile (hFile=0x1b0) returned 1 [0278.001] CloseHandle (hObject=0x1b0) returned 1 [0278.001] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.001] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0278.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.002] lstrlenW (lpString=".doc") returned 4 [0278.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.002] lstrlenW (lpString=".docx") returned 5 [0278.002] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.002] lstrlenW (lpString=".pdf") returned 4 [0278.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.002] lstrlenW (lpString=".xls") returned 4 [0278.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.002] lstrlenW (lpString=".xlsx") returned 5 [0278.002] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.002] lstrlenW (lpString=".ppt") returned 4 [0278.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.002] lstrlenW (lpString=".zip") returned 4 [0278.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.002] lstrlenW (lpString=".rar") returned 4 [0278.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.002] lstrlenW (lpString=".bz2") returned 4 [0278.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.002] lstrlenW (lpString=".7z") returned 3 [0278.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.002] lstrlenW (lpString=".dbf") returned 4 [0278.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.003] lstrlenW (lpString=".1cd") returned 4 [0278.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.003] lstrlenW (lpString=".jpg") returned 4 [0278.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.003] lstrlenW (lpString=".doc") returned 4 [0278.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString=".docx") returned 5 [0278.003] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0278.003] lstrlenW (lpString=".pdf") returned 4 [0278.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString=".xls") returned 4 [0278.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString=".xlsx") returned 5 [0278.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0278.003] lstrlenW (lpString=".ppt") returned 4 [0278.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.003] lstrlenW (lpString=".zip") returned 4 [0278.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString=".rar") returned 4 [0278.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0278.003] lstrlenW (lpString=".bz2") returned 4 [0278.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0278.003] lstrlenW (lpString=".7z") returned 3 [0278.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0278.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.004] lstrlenW (lpString=".dbf") returned 4 [0278.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0278.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.005] lstrlenW (lpString=".1cd") returned 4 [0278.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0278.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0278.005] lstrlenW (lpString=".jpg") returned 4 [0278.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0278.005] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0278.005] lstrlenW (lpString="OfficeLR.cab") returned 12 [0278.005] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0278.006] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=14127746) returned 1 [0278.006] CloseHandle (hObject=0x1b0) returned 1 [0278.006] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0278.006] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.006] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0278.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0278.008] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0278.008] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.008] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.023] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.023] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.042] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0278.042] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.204] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.345] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.345] WriteFile (in: hFile=0x1b0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0278.366] SetEndOfFile (hFile=0x1b0) returned 1 [0278.366] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0278.366] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.366] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.367] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.367] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.368] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0278.368] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0278.621] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0278.625] CloseHandle (hObject=0x1b0) returned 1 [0278.625] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.626] lstrlenW (lpString=".doc") returned 4 [0278.626] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString=".docx") returned 5 [0278.626] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.626] lstrlenW (lpString=".pdf") returned 4 [0278.626] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString=".xls") returned 4 [0278.626] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString=".xlsx") returned 5 [0278.626] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.626] lstrlenW (lpString=".ppt") returned 4 [0278.626] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.626] lstrlenW (lpString=".zip") returned 4 [0278.626] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString=".rar") returned 4 [0278.626] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString=".bz2") returned 4 [0278.626] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.626] lstrlenW (lpString=".7z") returned 3 [0278.626] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.626] lstrlenW (lpString=".dbf") returned 4 [0278.626] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.626] lstrlenW (lpString=".1cd") returned 4 [0278.626] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.627] lstrlenW (lpString=".jpg") returned 4 [0278.627] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.627] lstrlenW (lpString=".doc") returned 4 [0278.627] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString=".docx") returned 5 [0278.627] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0278.627] lstrlenW (lpString=".pdf") returned 4 [0278.627] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString=".xls") returned 4 [0278.627] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString=".xlsx") returned 5 [0278.627] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0278.627] lstrlenW (lpString=".ppt") returned 4 [0278.627] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.627] lstrlenW (lpString=".zip") returned 4 [0278.627] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString=".rar") returned 4 [0278.627] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString=".bz2") returned 4 [0278.627] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0278.627] lstrlenW (lpString=".7z") returned 3 [0278.627] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.627] lstrlenW (lpString=".dbf") returned 4 [0278.627] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.627] lstrlenW (lpString=".1cd") returned 4 [0278.627] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0278.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0278.628] lstrlenW (lpString=".jpg") returned 4 [0278.628] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0278.628] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0278.628] lstrlenW (lpString="ose.exe") returned 7 [0278.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0278.628] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=174440) returned 1 [0278.628] CloseHandle (hObject=0x1b0) returned 1 [0278.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0278.628] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0278.629] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.629] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0278.629] GetLastError () returned 0x0 [0278.629] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0278.651] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0278.655] ReadFile (in: hFile=0x1b0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0278.655] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0278.655] SetEndOfFile (hFile=0x1f4) returned 1 [0278.658] CloseHandle (hObject=0x1f4) returned 1 [0278.658] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0278.658] SetEndOfFile (hFile=0x1b0) returned 1 [0278.661] CloseHandle (hObject=0x1b0) returned 1 [0278.661] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0278.661] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0278.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.667] lstrlenW (lpString=".doc") returned 4 [0278.667] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0278.667] lstrlenW (lpString=".docx") returned 5 [0278.667] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0278.667] lstrlenW (lpString=".pdf") returned 4 [0278.667] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0278.667] lstrlenW (lpString=".xls") returned 4 [0278.667] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0278.667] lstrlenW (lpString=".xlsx") returned 5 [0278.667] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0278.667] lstrlenW (lpString=".ppt") returned 4 [0278.667] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0278.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.667] lstrlenW (lpString=".zip") returned 4 [0278.667] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0278.667] lstrlenW (lpString=".rar") returned 4 [0278.668] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0278.668] lstrlenW (lpString=".bz2") returned 4 [0278.668] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0278.668] lstrlenW (lpString=".7z") returned 3 [0278.668] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0278.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.668] lstrlenW (lpString=".dbf") returned 4 [0278.668] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0278.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.668] lstrlenW (lpString=".1cd") returned 4 [0278.668] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0278.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.668] lstrlenW (lpString=".jpg") returned 4 [0278.668] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0278.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.669] lstrlenW (lpString=".doc") returned 4 [0278.669] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0278.669] lstrlenW (lpString=".docx") returned 5 [0278.669] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0278.669] lstrlenW (lpString=".pdf") returned 4 [0278.669] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0278.669] lstrlenW (lpString=".xls") returned 4 [0278.669] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0278.669] lstrlenW (lpString=".xlsx") returned 5 [0278.671] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0278.671] lstrlenW (lpString=".ppt") returned 4 [0278.671] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0278.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.671] lstrlenW (lpString=".zip") returned 4 [0278.671] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0278.671] lstrlenW (lpString=".rar") returned 4 [0278.671] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0278.671] lstrlenW (lpString=".bz2") returned 4 [0278.671] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0278.671] lstrlenW (lpString=".7z") returned 3 [0278.671] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0278.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.671] lstrlenW (lpString=".dbf") returned 4 [0278.671] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0278.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.671] lstrlenW (lpString=".1cd") returned 4 [0278.671] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0278.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0278.671] lstrlenW (lpString=".jpg") returned 4 [0278.671] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0278.672] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0278.672] lstrlenW (lpString="osetup.dll") returned 10 [0278.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.683] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=7378792) returned 1 [0278.683] CloseHandle (hObject=0x1c0) returned 1 [0278.683] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0278.683] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0278.683] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0278.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0278.684] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0278.685] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.685] ReadFile (in: hFile=0x1c0, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0278.902] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0278.902] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.075] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0279.075] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.075] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.129] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0279.129] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0279.144] SetEndOfFile (hFile=0x1c0) returned 1 [0279.145] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f03870 [0279.311] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.311] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.414] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.414] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.417] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f03870*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03870*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.419] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0279.419] CloseHandle (hObject=0x1c0) returned 1 [0279.419] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.419] lstrlenW (lpString=".doc") returned 4 [0279.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.420] lstrlenW (lpString=".docx") returned 5 [0279.420] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0279.420] lstrlenW (lpString=".pdf") returned 4 [0279.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.420] lstrlenW (lpString=".xls") returned 4 [0279.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.420] lstrlenW (lpString=".xlsx") returned 5 [0279.420] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0279.420] lstrlenW (lpString=".ppt") returned 4 [0279.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.420] lstrlenW (lpString=".zip") returned 4 [0279.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.420] lstrlenW (lpString=".rar") returned 4 [0279.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.420] lstrlenW (lpString=".bz2") returned 4 [0279.420] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.420] lstrlenW (lpString=".7z") returned 3 [0279.420] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.420] lstrlenW (lpString=".dbf") returned 4 [0279.420] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.420] lstrlenW (lpString=".1cd") returned 4 [0279.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.421] lstrlenW (lpString=".jpg") returned 4 [0279.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.422] lstrlenW (lpString=".doc") returned 4 [0279.422] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0279.422] lstrlenW (lpString=".docx") returned 5 [0279.422] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0279.422] lstrlenW (lpString=".pdf") returned 4 [0279.422] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0279.422] lstrlenW (lpString=".xls") returned 4 [0279.422] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0279.422] lstrlenW (lpString=".xlsx") returned 5 [0279.422] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0279.422] lstrlenW (lpString=".ppt") returned 4 [0279.422] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0279.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.422] lstrlenW (lpString=".zip") returned 4 [0279.422] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0279.422] lstrlenW (lpString=".rar") returned 4 [0279.422] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0279.422] lstrlenW (lpString=".bz2") returned 4 [0279.422] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0279.422] lstrlenW (lpString=".7z") returned 3 [0279.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0279.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.422] lstrlenW (lpString=".dbf") returned 4 [0279.422] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0279.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.422] lstrlenW (lpString=".1cd") returned 4 [0279.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0279.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0279.423] lstrlenW (lpString=".jpg") returned 4 [0279.423] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0279.423] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0279.423] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0279.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0279.423] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=27532288) returned 1 [0279.423] CloseHandle (hObject=0x1c0) returned 1 [0279.423] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0279.423] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0279.424] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0279.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0279.424] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0279.424] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.424] ReadFile (in: hFile=0x1c0, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.479] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.479] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.536] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0279.536] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0279.536] ReadFile (in: hFile=0x1c0, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0279.649] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0279.649] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0279.670] SetEndOfFile (hFile=0x1c0) returned 1 [0279.670] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0279.674] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.674] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.675] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.675] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.678] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0279.678] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0279.680] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0279.680] CloseHandle (hObject=0x1c0) returned 1 [0279.727] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0279.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.727] lstrlenW (lpString=".doc") returned 4 [0279.727] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.727] lstrlenW (lpString=".docx") returned 5 [0279.727] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0279.727] lstrlenW (lpString=".pdf") returned 4 [0279.728] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.728] lstrlenW (lpString=".xls") returned 4 [0279.728] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.728] lstrlenW (lpString=".xlsx") returned 5 [0279.728] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0279.728] lstrlenW (lpString=".ppt") returned 4 [0279.728] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.728] lstrlenW (lpString=".zip") returned 4 [0279.728] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.728] lstrlenW (lpString=".rar") returned 4 [0279.728] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.728] lstrlenW (lpString=".bz2") returned 4 [0279.728] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.728] lstrlenW (lpString=".7z") returned 3 [0279.728] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.728] lstrlenW (lpString=".dbf") returned 4 [0279.728] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.728] lstrlenW (lpString=".1cd") returned 4 [0279.728] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.729] lstrlenW (lpString=".jpg") returned 4 [0279.729] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.729] lstrlenW (lpString=".doc") returned 4 [0279.729] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0279.729] lstrlenW (lpString=".docx") returned 5 [0279.729] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0279.729] lstrlenW (lpString=".pdf") returned 4 [0279.729] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0279.729] lstrlenW (lpString=".xls") returned 4 [0279.729] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0279.729] lstrlenW (lpString=".xlsx") returned 5 [0279.729] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0279.729] lstrlenW (lpString=".ppt") returned 4 [0279.729] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0279.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.729] lstrlenW (lpString=".zip") returned 4 [0279.729] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0279.729] lstrlenW (lpString=".rar") returned 4 [0279.729] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0279.729] lstrlenW (lpString=".bz2") returned 4 [0279.729] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0279.729] lstrlenW (lpString=".7z") returned 3 [0279.729] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0279.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.729] lstrlenW (lpString=".dbf") returned 4 [0279.729] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0279.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.730] lstrlenW (lpString=".1cd") returned 4 [0279.730] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0279.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0279.730] lstrlenW (lpString=".jpg") returned 4 [0279.730] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0279.730] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0279.730] lstrlenW (lpString="Office32WW.msi") returned 14 [0279.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0280.339] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1992192) returned 1 [0280.339] CloseHandle (hObject=0x174) returned 1 [0280.339] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0280.339] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0280.340] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0280.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0280.340] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0280.340] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0280.340] ReadFile (in: hFile=0x174, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0280.384] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0280.384] ReadFile (in: hFile=0x174, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0280.391] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0280.391] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0280.391] ReadFile (in: hFile=0x174, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0281.369] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0281.369] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0281.504] SetEndOfFile (hFile=0x174) returned 1 [0281.504] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fd48d8 [0281.505] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0281.505] WriteFile (in: hFile=0x174, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0281.526] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0281.526] WriteFile (in: hFile=0x174, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0281.528] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0281.528] WriteFile (in: hFile=0x174, lpBuffer=0x3fd48d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd48d8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0281.531] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0281.531] CloseHandle (hObject=0x174) returned 1 [0281.531] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0281.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.532] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.532] lstrlenW (lpString=".doc") returned 4 [0281.532] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0281.532] lstrlenW (lpString=".docx") returned 5 [0281.532] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0281.532] lstrlenW (lpString=".pdf") returned 4 [0281.532] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0281.532] lstrlenW (lpString=".xls") returned 4 [0281.532] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0281.532] lstrlenW (lpString=".xlsx") returned 5 [0281.532] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0281.532] lstrlenW (lpString=".ppt") returned 4 [0281.585] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0281.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.585] lstrlenW (lpString=".zip") returned 4 [0281.585] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0281.585] lstrlenW (lpString=".rar") returned 4 [0281.585] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0281.585] lstrlenW (lpString=".bz2") returned 4 [0281.585] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0281.585] lstrlenW (lpString=".7z") returned 3 [0281.585] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0281.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.585] lstrlenW (lpString=".dbf") returned 4 [0281.585] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0281.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.586] lstrlenW (lpString=".1cd") returned 4 [0281.586] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0281.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.586] lstrlenW (lpString=".jpg") returned 4 [0281.586] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0281.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.586] lstrlenW (lpString=".doc") returned 4 [0281.586] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0281.586] lstrlenW (lpString=".docx") returned 5 [0281.586] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0281.586] lstrlenW (lpString=".pdf") returned 4 [0281.586] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0281.586] lstrlenW (lpString=".xls") returned 4 [0281.586] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0281.586] lstrlenW (lpString=".xlsx") returned 5 [0281.586] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0281.586] lstrlenW (lpString=".ppt") returned 4 [0281.586] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0281.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.586] lstrlenW (lpString=".zip") returned 4 [0281.586] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0281.586] lstrlenW (lpString=".rar") returned 4 [0281.586] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0281.586] lstrlenW (lpString=".bz2") returned 4 [0281.586] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0281.586] lstrlenW (lpString=".7z") returned 3 [0281.587] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0281.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.587] lstrlenW (lpString=".dbf") returned 4 [0281.587] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0281.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.587] lstrlenW (lpString=".1cd") returned 4 [0281.587] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0281.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0281.587] lstrlenW (lpString=".jpg") returned 4 [0281.587] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0281.587] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0281.587] lstrlenW (lpString="PidGenX.dll") returned 11 [0281.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0281.588] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1463568) returned 1 [0281.588] CloseHandle (hObject=0x1c4) returned 1 [0281.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0281.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0281.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0281.588] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0281.588] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0281.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0281.787] GetLastError () returned 0x0 [0281.787] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0281.873] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0282.085] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0282.153] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0282.272] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0282.272] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0282.272] SetEndOfFile (hFile=0x174) returned 1 [0282.537] CloseHandle (hObject=0x174) returned 1 [0282.537] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.537] SetEndOfFile (hFile=0x1c4) returned 1 [0282.549] CloseHandle (hObject=0x1c4) returned 1 [0282.549] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0282.550] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0282.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.720] lstrlenW (lpString=".doc") returned 4 [0282.720] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString=".docx") returned 5 [0282.720] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0282.720] lstrlenW (lpString=".pdf") returned 4 [0282.720] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString=".xls") returned 4 [0282.720] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString=".xlsx") returned 5 [0282.720] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0282.720] lstrlenW (lpString=".ppt") returned 4 [0282.720] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.720] lstrlenW (lpString=".zip") returned 4 [0282.720] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString=".rar") returned 4 [0282.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString=".bz2") returned 4 [0282.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.720] lstrlenW (lpString=".7z") returned 3 [0282.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.720] lstrlenW (lpString=".dbf") returned 4 [0282.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.720] lstrlenW (lpString=".1cd") returned 4 [0282.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.720] lstrlenW (lpString=".jpg") returned 4 [0282.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.721] lstrlenW (lpString=".doc") returned 4 [0282.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0282.721] lstrlenW (lpString=".docx") returned 5 [0282.721] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0282.721] lstrlenW (lpString=".pdf") returned 4 [0282.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0282.721] lstrlenW (lpString=".xls") returned 4 [0282.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0282.721] lstrlenW (lpString=".xlsx") returned 5 [0282.721] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0282.721] lstrlenW (lpString=".ppt") returned 4 [0282.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0282.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.721] lstrlenW (lpString=".zip") returned 4 [0282.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0282.721] lstrlenW (lpString=".rar") returned 4 [0282.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0282.721] lstrlenW (lpString=".bz2") returned 4 [0282.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0282.721] lstrlenW (lpString=".7z") returned 3 [0282.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0282.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.721] lstrlenW (lpString=".dbf") returned 4 [0282.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0282.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.721] lstrlenW (lpString=".1cd") returned 4 [0282.721] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0282.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0282.721] lstrlenW (lpString=".jpg") returned 4 [0282.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0282.722] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0282.722] lstrlenW (lpString="Office32WW.msi") returned 14 [0282.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0282.722] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1992192) returned 1 [0282.722] CloseHandle (hObject=0x180) returned 1 [0282.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0282.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.723] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0282.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0282.723] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0282.723] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0282.723] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0282.746] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0282.746] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0282.763] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0282.763] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0282.763] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0282.796] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.796] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0282.857] SetEndOfFile (hFile=0x180) returned 1 [0282.857] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0282.861] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0282.861] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.862] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0282.862] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.864] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0282.864] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0282.866] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0282.866] CloseHandle (hObject=0x180) returned 1 [0282.866] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0282.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.866] lstrlenW (lpString=".doc") returned 4 [0282.867] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0282.867] lstrlenW (lpString=".docx") returned 5 [0282.867] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0282.867] lstrlenW (lpString=".pdf") returned 4 [0282.867] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0282.867] lstrlenW (lpString=".xls") returned 4 [0282.867] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0282.867] lstrlenW (lpString=".xlsx") returned 5 [0282.867] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0282.867] lstrlenW (lpString=".ppt") returned 4 [0282.867] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0282.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.867] lstrlenW (lpString=".zip") returned 4 [0282.867] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0282.867] lstrlenW (lpString=".rar") returned 4 [0282.867] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0282.867] lstrlenW (lpString=".bz2") returned 4 [0282.867] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0282.867] lstrlenW (lpString=".7z") returned 3 [0282.867] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0282.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.867] lstrlenW (lpString=".dbf") returned 4 [0282.867] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0282.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.867] lstrlenW (lpString=".1cd") returned 4 [0282.867] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0282.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.867] lstrlenW (lpString=".jpg") returned 4 [0282.867] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0282.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.867] lstrlenW (lpString=".doc") returned 4 [0282.867] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0282.867] lstrlenW (lpString=".docx") returned 5 [0282.867] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0282.867] lstrlenW (lpString=".pdf") returned 4 [0282.867] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0282.868] lstrlenW (lpString=".xls") returned 4 [0282.868] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0282.868] lstrlenW (lpString=".xlsx") returned 5 [0282.868] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0282.868] lstrlenW (lpString=".ppt") returned 4 [0282.868] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0282.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.868] lstrlenW (lpString=".zip") returned 4 [0282.868] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0282.868] lstrlenW (lpString=".rar") returned 4 [0282.868] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0282.868] lstrlenW (lpString=".bz2") returned 4 [0282.868] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0282.868] lstrlenW (lpString=".7z") returned 3 [0282.868] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0282.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.868] lstrlenW (lpString=".dbf") returned 4 [0282.868] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0282.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.868] lstrlenW (lpString=".1cd") returned 4 [0282.868] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0282.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0282.868] lstrlenW (lpString=".jpg") returned 4 [0282.868] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0282.868] lstrcmpiW (lpString1=".exe", lpString2=".drweb") returned 1 [0282.868] lstrlenW (lpString="ose.exe") returned 7 [0282.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0282.984] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=174440) returned 1 [0282.984] CloseHandle (hObject=0x180) returned 1 [0282.984] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0282.984] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0282.984] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0282.985] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.985] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0282.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0282.985] GetLastError () returned 0x0 [0282.985] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0283.061] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0283.066] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0283.066] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0283.066] SetEndOfFile (hFile=0x1c0) returned 1 [0283.066] CloseHandle (hObject=0x1c0) returned 1 [0283.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.066] SetEndOfFile (hFile=0x180) returned 1 [0283.068] CloseHandle (hObject=0x180) returned 1 [0283.068] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.069] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0283.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.069] lstrlenW (lpString=".doc") returned 4 [0283.069] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0283.069] lstrlenW (lpString=".docx") returned 5 [0283.069] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0283.069] lstrlenW (lpString=".pdf") returned 4 [0283.069] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0283.069] lstrlenW (lpString=".xls") returned 4 [0283.069] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0283.069] lstrlenW (lpString=".xlsx") returned 5 [0283.069] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0283.069] lstrlenW (lpString=".ppt") returned 4 [0283.069] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0283.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.070] lstrlenW (lpString=".zip") returned 4 [0283.070] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0283.070] lstrlenW (lpString=".rar") returned 4 [0283.070] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0283.070] lstrlenW (lpString=".bz2") returned 4 [0283.070] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0283.070] lstrlenW (lpString=".7z") returned 3 [0283.070] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0283.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.070] lstrlenW (lpString=".dbf") returned 4 [0283.070] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0283.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.070] lstrlenW (lpString=".1cd") returned 4 [0283.070] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0283.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.070] lstrlenW (lpString=".jpg") returned 4 [0283.070] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0283.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.070] lstrlenW (lpString=".doc") returned 4 [0283.070] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0283.070] lstrlenW (lpString=".docx") returned 5 [0283.070] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0283.070] lstrlenW (lpString=".pdf") returned 4 [0283.070] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0283.070] lstrlenW (lpString=".xls") returned 4 [0283.071] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0283.071] lstrlenW (lpString=".xlsx") returned 5 [0283.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0283.071] lstrlenW (lpString=".ppt") returned 4 [0283.071] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0283.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.071] lstrlenW (lpString=".zip") returned 4 [0283.071] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0283.071] lstrlenW (lpString=".rar") returned 4 [0283.071] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0283.071] lstrlenW (lpString=".bz2") returned 4 [0283.071] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0283.071] lstrlenW (lpString=".7z") returned 3 [0283.071] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0283.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.071] lstrlenW (lpString=".dbf") returned 4 [0283.071] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0283.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.071] lstrlenW (lpString=".1cd") returned 4 [0283.071] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0283.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0283.071] lstrlenW (lpString=".jpg") returned 4 [0283.071] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0283.072] lstrcmpiW (lpString1=".cab", lpString2=".drweb") returned -1 [0283.072] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0283.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.072] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=36233052) returned 1 [0283.072] CloseHandle (hObject=0x180) returned 1 [0283.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0283.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.073] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0283.073] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0283.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0283.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.074] ReadFile (in: hFile=0x180, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.158] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.158] ReadFile (in: hFile=0x180, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.311] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0283.311] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.311] ReadFile (in: hFile=0x180, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0283.450] WriteFile (in: hFile=0x180, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0283.466] SetEndOfFile (hFile=0x180) returned 1 [0283.466] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3fe48e0 [0283.466] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0283.466] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.467] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0283.467] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.467] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0283.467] WriteFile (in: hFile=0x180, lpBuffer=0x3fe48e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe48e0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0283.469] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fe48e0 | out: hHeap=0x2e0000) returned 1 [0283.469] CloseHandle (hObject=0x180) returned 1 [0283.469] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0283.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.469] lstrlenW (lpString=".doc") returned 4 [0283.470] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString=".docx") returned 5 [0283.470] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0283.470] lstrlenW (lpString=".pdf") returned 4 [0283.470] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString=".xls") returned 4 [0283.470] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString=".xlsx") returned 5 [0283.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0283.470] lstrlenW (lpString=".ppt") returned 4 [0283.470] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.470] lstrlenW (lpString=".zip") returned 4 [0283.470] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString=".rar") returned 4 [0283.470] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString=".bz2") returned 4 [0283.470] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0283.470] lstrlenW (lpString=".7z") returned 3 [0283.470] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0283.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.470] lstrlenW (lpString=".dbf") returned 4 [0283.470] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.470] lstrlenW (lpString=".1cd") returned 4 [0283.470] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0283.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.470] lstrlenW (lpString=".jpg") returned 4 [0283.470] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.470] lstrlenW (lpString=".doc") returned 4 [0283.470] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0283.470] lstrlenW (lpString=".docx") returned 5 [0283.470] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0283.471] lstrlenW (lpString=".pdf") returned 4 [0283.471] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0283.471] lstrlenW (lpString=".xls") returned 4 [0283.471] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0283.471] lstrlenW (lpString=".xlsx") returned 5 [0283.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0283.471] lstrlenW (lpString=".ppt") returned 4 [0283.471] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0283.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.471] lstrlenW (lpString=".zip") returned 4 [0283.471] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0283.471] lstrlenW (lpString=".rar") returned 4 [0283.547] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0283.547] lstrlenW (lpString=".bz2") returned 4 [0283.547] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0283.548] lstrlenW (lpString=".7z") returned 3 [0283.548] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0283.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.548] lstrlenW (lpString=".dbf") returned 4 [0283.548] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0283.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.548] lstrlenW (lpString=".1cd") returned 4 [0283.548] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0283.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0283.548] lstrlenW (lpString=".jpg") returned 4 [0283.548] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0283.548] lstrcmpiW (lpString1=".msi", lpString2=".drweb") returned 1 [0283.548] lstrlenW (lpString="VisiorWW.msi") returned 12 [0283.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0283.555] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=12060672) returned 1 [0283.555] CloseHandle (hObject=0x20c) returned 1 [0283.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0283.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0283.555] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[dr.web24@aol.com].drweb")) returned 1 [0283.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0283.556] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0283.556] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.556] ReadFile (in: hFile=0x20c, lpBuffer=0x3dc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3dc0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.708] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.708] ReadFile (in: hFile=0x20c, lpBuffer=0x3e00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e00058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0283.939] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0283.939] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0283.939] ReadFile (in: hFile=0x20c, lpBuffer=0x3e40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e40058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0284.117] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.117] WriteFile (in: hFile=0x20c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0284.308] SetEndOfFile (hFile=0x20c) returned 1 [0284.308] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x40000) returned 0x3f53880 [0284.309] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0284.309] WriteFile (in: hFile=0x20c, lpBuffer=0x3f53880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53880*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.310] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0284.310] WriteFile (in: hFile=0x20c, lpBuffer=0x3f53880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53880*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.318] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0284.318] WriteFile (in: hFile=0x20c, lpBuffer=0x3f53880*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53880*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0284.320] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f53880 | out: hHeap=0x2e0000) returned 1 [0284.320] CloseHandle (hObject=0x20c) returned 1 [0284.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x2020) returned 1 [0284.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.320] lstrlenW (lpString=".doc") returned 4 [0284.320] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0284.320] lstrlenW (lpString=".docx") returned 5 [0284.320] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0284.320] lstrlenW (lpString=".pdf") returned 4 [0284.320] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0284.320] lstrlenW (lpString=".xls") returned 4 [0284.320] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0284.320] lstrlenW (lpString=".xlsx") returned 5 [0284.320] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0284.320] lstrlenW (lpString=".ppt") returned 4 [0284.321] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0284.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.321] lstrlenW (lpString=".zip") returned 4 [0284.321] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0284.321] lstrlenW (lpString=".rar") returned 4 [0284.321] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0284.321] lstrlenW (lpString=".bz2") returned 4 [0284.321] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0284.321] lstrlenW (lpString=".7z") returned 3 [0284.321] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0284.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.321] lstrlenW (lpString=".dbf") returned 4 [0284.321] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0284.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.321] lstrlenW (lpString=".1cd") returned 4 [0284.321] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0284.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.321] lstrlenW (lpString=".jpg") returned 4 [0284.321] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0284.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.321] lstrlenW (lpString=".doc") returned 4 [0284.321] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0284.321] lstrlenW (lpString=".docx") returned 5 [0284.321] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0284.321] lstrlenW (lpString=".pdf") returned 4 [0284.321] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0284.321] lstrlenW (lpString=".xls") returned 4 [0284.321] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0284.321] lstrlenW (lpString=".xlsx") returned 5 [0284.321] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0284.321] lstrlenW (lpString=".ppt") returned 4 [0284.321] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0284.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.322] lstrlenW (lpString=".zip") returned 4 [0284.322] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0284.322] lstrlenW (lpString=".rar") returned 4 [0284.322] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0284.322] lstrlenW (lpString=".bz2") returned 4 [0284.322] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0284.322] lstrlenW (lpString=".7z") returned 3 [0284.322] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0284.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.322] lstrlenW (lpString=".dbf") returned 4 [0284.322] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0284.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.322] lstrlenW (lpString=".1cd") returned 4 [0284.322] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0284.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0284.322] lstrlenW (lpString=".jpg") returned 4 [0284.322] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0284.322] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0284.322] lstrlenW (lpString="msgfilt.dll") returned 11 [0284.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.751] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=38768) returned 1 [0284.752] CloseHandle (hObject=0x1c4) returned 1 [0284.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0284.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.752] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.752] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0284.753] GetLastError () returned 0x0 [0284.753] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x9770, lpOverlapped=0x0) returned 1 [0284.758] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x9780, lpOverlapped=0x0) returned 1 [0284.761] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.761] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0284.761] SetEndOfFile (hFile=0x1f4) returned 1 [0284.761] CloseHandle (hObject=0x1f4) returned 1 [0284.761] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.761] SetEndOfFile (hFile=0x1c4) returned 1 [0284.762] CloseHandle (hObject=0x1c4) returned 1 [0284.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0284.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.763] lstrlenW (lpString=".doc") returned 4 [0284.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.763] lstrlenW (lpString=".docx") returned 5 [0284.763] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0284.763] lstrlenW (lpString=".pdf") returned 4 [0284.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.763] lstrlenW (lpString=".xls") returned 4 [0284.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.763] lstrlenW (lpString=".xlsx") returned 5 [0284.763] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0284.763] lstrlenW (lpString=".ppt") returned 4 [0284.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.763] lstrlenW (lpString=".zip") returned 4 [0284.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.763] lstrlenW (lpString=".rar") returned 4 [0284.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.763] lstrlenW (lpString=".bz2") returned 4 [0284.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.763] lstrlenW (lpString=".7z") returned 3 [0284.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.763] lstrlenW (lpString=".dbf") returned 4 [0284.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.764] lstrlenW (lpString=".1cd") returned 4 [0284.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.764] lstrlenW (lpString=".jpg") returned 4 [0284.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.764] lstrlenW (lpString=".doc") returned 4 [0284.765] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0284.766] lstrlenW (lpString=".docx") returned 5 [0284.766] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0284.766] lstrlenW (lpString=".pdf") returned 4 [0284.766] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0284.766] lstrlenW (lpString=".xls") returned 4 [0284.766] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0284.766] lstrlenW (lpString=".xlsx") returned 5 [0284.766] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0284.766] lstrlenW (lpString=".ppt") returned 4 [0284.766] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0284.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.766] lstrlenW (lpString=".zip") returned 4 [0284.766] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0284.766] lstrlenW (lpString=".rar") returned 4 [0284.766] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0284.766] lstrlenW (lpString=".bz2") returned 4 [0284.766] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0284.766] lstrlenW (lpString=".7z") returned 3 [0284.766] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0284.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.767] lstrlenW (lpString=".dbf") returned 4 [0284.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0284.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.767] lstrlenW (lpString=".1cd") returned 4 [0284.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0284.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0284.767] lstrlenW (lpString=".jpg") returned 4 [0284.767] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0284.767] lstrcmpiW (lpString1=".CFG", lpString2=".drweb") returned -1 [0284.767] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0284.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.768] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=6811) returned 1 [0284.768] CloseHandle (hObject=0x1c4) returned 1 [0284.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0284.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.769] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.769] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0284.769] GetLastError () returned 0x0 [0284.769] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0284.771] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0284.772] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.772] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0284.772] SetEndOfFile (hFile=0x1f4) returned 1 [0284.772] CloseHandle (hObject=0x1f4) returned 1 [0284.772] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.772] SetEndOfFile (hFile=0x1c4) returned 1 [0284.773] CloseHandle (hObject=0x1c4) returned 1 [0284.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.773] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0284.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.773] lstrlenW (lpString=".doc") returned 4 [0284.773] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0284.773] lstrlenW (lpString=".docx") returned 5 [0284.774] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0284.774] lstrlenW (lpString=".pdf") returned 4 [0284.774] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString=".xls") returned 4 [0284.774] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString=".xlsx") returned 5 [0284.774] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0284.774] lstrlenW (lpString=".ppt") returned 4 [0284.774] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.774] lstrlenW (lpString=".zip") returned 4 [0284.774] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString=".rar") returned 4 [0284.774] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString=".bz2") returned 4 [0284.774] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0284.774] lstrlenW (lpString=".7z") returned 3 [0284.774] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0284.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.774] lstrlenW (lpString=".dbf") returned 4 [0284.774] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.774] lstrlenW (lpString=".1cd") returned 4 [0284.774] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0284.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.774] lstrlenW (lpString=".jpg") returned 4 [0284.774] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.774] lstrlenW (lpString=".doc") returned 4 [0284.774] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString=".docx") returned 5 [0284.774] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0284.774] lstrlenW (lpString=".pdf") returned 4 [0284.774] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0284.774] lstrlenW (lpString=".xls") returned 4 [0284.775] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0284.775] lstrlenW (lpString=".xlsx") returned 5 [0284.775] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0284.775] lstrlenW (lpString=".ppt") returned 4 [0284.775] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0284.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.775] lstrlenW (lpString=".zip") returned 4 [0284.775] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0284.775] lstrlenW (lpString=".rar") returned 4 [0284.775] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0284.775] lstrlenW (lpString=".bz2") returned 4 [0284.775] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0284.775] lstrlenW (lpString=".7z") returned 3 [0284.775] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0284.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.775] lstrlenW (lpString=".dbf") returned 4 [0284.775] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0284.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.775] lstrlenW (lpString=".1cd") returned 4 [0284.775] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0284.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0284.775] lstrlenW (lpString=".jpg") returned 4 [0284.775] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0284.775] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0284.775] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0284.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.777] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=323936) returned 1 [0284.777] CloseHandle (hObject=0x1c4) returned 1 [0284.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0284.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0284.777] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.777] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0284.777] GetLastError () returned 0x0 [0284.777] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x4f160, lpOverlapped=0x0) returned 1 [0284.784] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0284.790] ReadFile (in: hFile=0x1c4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.790] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0284.790] SetEndOfFile (hFile=0x1f4) returned 1 [0284.790] CloseHandle (hObject=0x1f4) returned 1 [0284.791] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.791] SetEndOfFile (hFile=0x1c4) returned 1 [0284.794] CloseHandle (hObject=0x1c4) returned 1 [0284.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0284.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.794] lstrlenW (lpString=".doc") returned 4 [0284.794] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0284.794] lstrlenW (lpString=".docx") returned 5 [0284.794] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0284.795] lstrlenW (lpString=".pdf") returned 4 [0284.795] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0284.795] lstrlenW (lpString=".xls") returned 4 [0284.795] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0284.795] lstrlenW (lpString=".xlsx") returned 5 [0284.795] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0284.795] lstrlenW (lpString=".ppt") returned 4 [0284.795] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0284.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.795] lstrlenW (lpString=".zip") returned 4 [0284.795] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0284.795] lstrlenW (lpString=".rar") returned 4 [0284.795] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0284.795] lstrlenW (lpString=".bz2") returned 4 [0284.795] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0284.795] lstrlenW (lpString=".7z") returned 3 [0284.795] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0284.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.795] lstrlenW (lpString=".dbf") returned 4 [0284.795] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0284.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.795] lstrlenW (lpString=".1cd") returned 4 [0284.795] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0284.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.795] lstrlenW (lpString=".jpg") returned 4 [0284.795] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0284.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.796] lstrlenW (lpString=".doc") returned 4 [0284.796] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0284.796] lstrlenW (lpString=".docx") returned 5 [0284.796] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0284.796] lstrlenW (lpString=".pdf") returned 4 [0284.796] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0284.796] lstrlenW (lpString=".xls") returned 4 [0284.796] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0284.796] lstrlenW (lpString=".xlsx") returned 5 [0284.796] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0284.796] lstrlenW (lpString=".ppt") returned 4 [0284.796] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0284.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.796] lstrlenW (lpString=".zip") returned 4 [0284.796] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0284.796] lstrlenW (lpString=".rar") returned 4 [0284.796] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0284.796] lstrlenW (lpString=".bz2") returned 4 [0284.796] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0284.796] lstrlenW (lpString=".7z") returned 3 [0284.796] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0284.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.796] lstrlenW (lpString=".dbf") returned 4 [0284.796] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0284.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.796] lstrlenW (lpString=".1cd") returned 4 [0284.796] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0284.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0284.796] lstrlenW (lpString=".jpg") returned 4 [0284.796] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0284.797] lstrcmpiW (lpString1=".FNT", lpString2=".drweb") returned 1 [0284.797] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0284.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0284.918] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=606062) returned 1 [0284.918] CloseHandle (hObject=0x1f4) returned 1 [0284.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0284.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0284.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0284.918] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.918] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0284.919] GetLastError () returned 0x0 [0284.919] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0284.942] WriteFile (in: hFile=0x218, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0284.957] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0284.957] WriteFile (in: hFile=0x218, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0284.958] SetEndOfFile (hFile=0x218) returned 1 [0284.958] CloseHandle (hObject=0x218) returned 1 [0284.958] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0284.958] SetEndOfFile (hFile=0x1f4) returned 1 [0284.965] CloseHandle (hObject=0x1f4) returned 1 [0284.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0284.965] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0284.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.966] lstrlenW (lpString=".doc") returned 4 [0284.966] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0284.966] lstrlenW (lpString=".docx") returned 5 [0284.966] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0284.966] lstrlenW (lpString=".pdf") returned 4 [0284.966] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0284.966] lstrlenW (lpString=".xls") returned 4 [0284.966] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0284.966] lstrlenW (lpString=".xlsx") returned 5 [0284.966] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0284.966] lstrlenW (lpString=".ppt") returned 4 [0284.966] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0284.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.966] lstrlenW (lpString=".zip") returned 4 [0284.966] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0284.966] lstrlenW (lpString=".rar") returned 4 [0284.966] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0284.966] lstrlenW (lpString=".bz2") returned 4 [0284.966] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0284.966] lstrlenW (lpString=".7z") returned 3 [0284.966] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0284.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.966] lstrlenW (lpString=".dbf") returned 4 [0284.966] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0284.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.966] lstrlenW (lpString=".1cd") returned 4 [0284.967] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.967] lstrlenW (lpString=".jpg") returned 4 [0284.967] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.967] lstrlenW (lpString=".doc") returned 4 [0284.967] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0284.967] lstrlenW (lpString=".docx") returned 5 [0284.967] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0284.967] lstrlenW (lpString=".pdf") returned 4 [0284.967] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0284.967] lstrlenW (lpString=".xls") returned 4 [0284.967] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0284.967] lstrlenW (lpString=".xlsx") returned 5 [0284.967] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0284.967] lstrlenW (lpString=".ppt") returned 4 [0284.967] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0284.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.967] lstrlenW (lpString=".zip") returned 4 [0284.967] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0284.967] lstrlenW (lpString=".rar") returned 4 [0284.967] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0284.967] lstrlenW (lpString=".bz2") returned 4 [0284.968] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0284.968] lstrlenW (lpString=".7z") returned 3 [0284.968] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0284.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.968] lstrlenW (lpString=".dbf") returned 4 [0284.968] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0284.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.968] lstrlenW (lpString=".1cd") returned 4 [0284.968] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0284.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0284.968] lstrlenW (lpString=".jpg") returned 4 [0284.968] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0284.968] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0284.968] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0284.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0285.057] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=712592) returned 1 [0285.057] CloseHandle (hObject=0x1f4) returned 1 [0285.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0285.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0285.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.068] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0285.069] GetLastError () returned 0x0 [0285.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0xadf90, lpOverlapped=0x0) returned 1 [0285.081] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0285.096] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0285.096] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.096] SetEndOfFile (hFile=0x1c0) returned 1 [0285.096] CloseHandle (hObject=0x1c0) returned 1 [0285.097] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.097] SetEndOfFile (hFile=0x1f4) returned 1 [0285.103] CloseHandle (hObject=0x1f4) returned 1 [0285.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.103] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0285.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.103] lstrlenW (lpString=".doc") returned 4 [0285.103] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.103] lstrlenW (lpString=".docx") returned 5 [0285.103] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.104] lstrlenW (lpString=".pdf") returned 4 [0285.104] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString=".xls") returned 4 [0285.104] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString=".xlsx") returned 5 [0285.104] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.104] lstrlenW (lpString=".ppt") returned 4 [0285.104] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.104] lstrlenW (lpString=".zip") returned 4 [0285.104] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString=".rar") returned 4 [0285.104] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString=".bz2") returned 4 [0285.104] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.104] lstrlenW (lpString=".7z") returned 3 [0285.104] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.104] lstrlenW (lpString=".dbf") returned 4 [0285.104] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.104] lstrlenW (lpString=".1cd") returned 4 [0285.104] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.104] lstrlenW (lpString=".jpg") returned 4 [0285.104] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.104] lstrlenW (lpString=".doc") returned 4 [0285.104] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.104] lstrlenW (lpString=".docx") returned 5 [0285.104] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.104] lstrlenW (lpString=".pdf") returned 4 [0285.104] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.104] lstrlenW (lpString=".xls") returned 4 [0285.104] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.105] lstrlenW (lpString=".xlsx") returned 5 [0285.105] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.105] lstrlenW (lpString=".ppt") returned 4 [0285.105] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.105] lstrlenW (lpString=".zip") returned 4 [0285.105] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.105] lstrlenW (lpString=".rar") returned 4 [0285.105] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.105] lstrlenW (lpString=".bz2") returned 4 [0285.105] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.105] lstrlenW (lpString=".7z") returned 3 [0285.105] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.105] lstrlenW (lpString=".dbf") returned 4 [0285.105] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.105] lstrlenW (lpString=".1cd") returned 4 [0285.105] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0285.105] lstrlenW (lpString=".jpg") returned 4 [0285.105] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.105] lstrcmpiW (lpString1=".WPG", lpString2=".drweb") returned 1 [0285.105] lstrlenW (lpString="MS.WPG") returned 6 [0285.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0285.106] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1382) returned 1 [0285.106] CloseHandle (hObject=0x1f4) returned 1 [0285.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0285.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0285.106] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.106] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0285.107] GetLastError () returned 0x0 [0285.107] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x566, lpOverlapped=0x0) returned 1 [0285.154] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x570, lpOverlapped=0x0) returned 1 [0285.155] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0285.155] WriteFile (in: hFile=0x1c0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0285.155] SetEndOfFile (hFile=0x1c0) returned 1 [0285.344] CloseHandle (hObject=0x1c0) returned 1 [0285.414] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.414] SetEndOfFile (hFile=0x1f4) returned 1 [0285.415] CloseHandle (hObject=0x1f4) returned 1 [0285.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0285.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.416] lstrlenW (lpString=".doc") returned 4 [0285.416] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0285.416] lstrlenW (lpString=".docx") returned 5 [0285.416] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0285.416] lstrlenW (lpString=".pdf") returned 4 [0285.416] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0285.416] lstrlenW (lpString=".xls") returned 4 [0285.416] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0285.416] lstrlenW (lpString=".xlsx") returned 5 [0285.416] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0285.416] lstrlenW (lpString=".ppt") returned 4 [0285.416] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0285.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.416] lstrlenW (lpString=".zip") returned 4 [0285.416] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0285.416] lstrlenW (lpString=".rar") returned 4 [0285.416] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString=".bz2") returned 4 [0285.417] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString=".7z") returned 3 [0285.417] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0285.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.417] lstrlenW (lpString=".dbf") returned 4 [0285.417] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.417] lstrlenW (lpString=".1cd") returned 4 [0285.417] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.417] lstrlenW (lpString=".jpg") returned 4 [0285.417] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.417] lstrlenW (lpString=".doc") returned 4 [0285.417] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString=".docx") returned 5 [0285.417] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0285.417] lstrlenW (lpString=".pdf") returned 4 [0285.417] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0285.417] lstrlenW (lpString=".xls") returned 4 [0285.417] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0285.417] lstrlenW (lpString=".xlsx") returned 5 [0285.417] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0285.417] lstrlenW (lpString=".ppt") returned 4 [0285.418] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0285.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.418] lstrlenW (lpString=".zip") returned 4 [0285.418] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0285.418] lstrlenW (lpString=".rar") returned 4 [0285.418] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0285.418] lstrlenW (lpString=".bz2") returned 4 [0285.418] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0285.418] lstrlenW (lpString=".7z") returned 3 [0285.418] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0285.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.418] lstrlenW (lpString=".dbf") returned 4 [0285.418] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0285.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.418] lstrlenW (lpString=".1cd") returned 4 [0285.418] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0285.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0285.418] lstrlenW (lpString=".jpg") returned 4 [0285.418] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0285.418] lstrcmpiW (lpString1=".FLT", lpString2=".drweb") returned 1 [0285.418] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0285.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0285.453] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=280448) returned 1 [0285.454] CloseHandle (hObject=0x164) returned 1 [0285.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0285.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0285.454] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.454] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0285.455] GetLastError () returned 0x0 [0285.455] ReadFile (in: hFile=0x164, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x44780, lpOverlapped=0x0) returned 1 [0285.463] WriteFile (in: hFile=0x204, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x44790, lpOverlapped=0x0) returned 1 [0285.471] ReadFile (in: hFile=0x164, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0285.471] WriteFile (in: hFile=0x204, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.471] SetEndOfFile (hFile=0x204) returned 1 [0285.471] CloseHandle (hObject=0x204) returned 1 [0285.478] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.478] SetEndOfFile (hFile=0x164) returned 1 [0285.482] CloseHandle (hObject=0x164) returned 1 [0285.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.482] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0285.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.482] lstrlenW (lpString=".doc") returned 4 [0285.483] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.483] lstrlenW (lpString=".docx") returned 5 [0285.483] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.483] lstrlenW (lpString=".pdf") returned 4 [0285.483] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.483] lstrlenW (lpString=".xls") returned 4 [0285.483] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.483] lstrlenW (lpString=".xlsx") returned 5 [0285.483] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.483] lstrlenW (lpString=".ppt") returned 4 [0285.483] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.483] lstrlenW (lpString=".zip") returned 4 [0285.483] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.483] lstrlenW (lpString=".rar") returned 4 [0285.483] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.483] lstrlenW (lpString=".bz2") returned 4 [0285.483] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.483] lstrlenW (lpString=".7z") returned 3 [0285.483] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.484] lstrlenW (lpString=".dbf") returned 4 [0285.484] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.484] lstrlenW (lpString=".1cd") returned 4 [0285.484] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.484] lstrlenW (lpString=".jpg") returned 4 [0285.484] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.484] lstrlenW (lpString=".doc") returned 4 [0285.484] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0285.484] lstrlenW (lpString=".docx") returned 5 [0285.484] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0285.484] lstrlenW (lpString=".pdf") returned 4 [0285.484] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0285.484] lstrlenW (lpString=".xls") returned 4 [0285.485] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0285.485] lstrlenW (lpString=".xlsx") returned 5 [0285.485] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0285.485] lstrlenW (lpString=".ppt") returned 4 [0285.485] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0285.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.485] lstrlenW (lpString=".zip") returned 4 [0285.485] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0285.485] lstrlenW (lpString=".rar") returned 4 [0285.485] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0285.485] lstrlenW (lpString=".bz2") returned 4 [0285.485] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0285.485] lstrlenW (lpString=".7z") returned 3 [0285.485] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0285.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.485] lstrlenW (lpString=".dbf") returned 4 [0285.485] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0285.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.485] lstrlenW (lpString=".1cd") returned 4 [0285.485] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0285.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0285.485] lstrlenW (lpString=".jpg") returned 4 [0285.485] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0285.486] lstrcmpiW (lpString1=".dll", lpString2=".drweb") returned -1 [0285.486] lstrlenW (lpString="msitss55.dll") returned 12 [0285.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0285.506] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=430080) returned 1 [0285.506] CloseHandle (hObject=0x1f8) returned 1 [0285.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0285.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0285.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0285.507] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.507] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0285.881] GetLastError () returned 0x0 [0285.881] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x69000, lpOverlapped=0x0) returned 1 [0285.893] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x69010, lpOverlapped=0x0) returned 1 [0285.904] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0285.904] WriteFile (in: hFile=0x1f4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0285.904] SetEndOfFile (hFile=0x1f4) returned 1 [0285.904] CloseHandle (hObject=0x1f4) returned 1 [0285.904] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0285.904] SetEndOfFile (hFile=0x1f8) returned 1 [0285.909] CloseHandle (hObject=0x1f8) returned 1 [0285.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[dr.web24@aol.com].drweb", dwFileAttributes=0x20) returned 1 [0285.910] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0285.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.910] lstrlenW (lpString=".doc") returned 4 [0285.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.910] lstrlenW (lpString=".docx") returned 5 [0285.910] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0285.910] lstrlenW (lpString=".pdf") returned 4 [0285.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.910] lstrlenW (lpString=".xls") returned 4 [0285.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.910] lstrlenW (lpString=".xlsx") returned 5 [0285.910] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0285.910] lstrlenW (lpString=".ppt") returned 4 [0285.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.910] lstrlenW (lpString=".zip") returned 4 [0285.911] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.911] lstrlenW (lpString=".rar") returned 4 [0285.911] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.911] lstrlenW (lpString=".bz2") returned 4 [0285.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.911] lstrlenW (lpString=".7z") returned 3 [0285.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.911] lstrlenW (lpString=".dbf") returned 4 [0285.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.911] lstrlenW (lpString=".1cd") returned 4 [0285.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.911] lstrlenW (lpString=".jpg") returned 4 [0285.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.911] lstrlenW (lpString=".doc") returned 4 [0285.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0285.911] lstrlenW (lpString=".docx") returned 5 [0285.911] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0285.911] lstrlenW (lpString=".pdf") returned 4 [0285.911] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0285.911] lstrlenW (lpString=".xls") returned 4 [0285.911] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0285.911] lstrlenW (lpString=".xlsx") returned 5 [0285.911] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0285.912] lstrlenW (lpString=".ppt") returned 4 [0285.912] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0285.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.912] lstrlenW (lpString=".zip") returned 4 [0285.912] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0285.912] lstrlenW (lpString=".rar") returned 4 [0285.912] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0285.912] lstrlenW (lpString=".bz2") returned 4 [0285.912] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0285.912] lstrlenW (lpString=".7z") returned 3 [0285.912] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0285.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.912] lstrlenW (lpString=".dbf") returned 4 [0285.912] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0285.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.912] lstrlenW (lpString=".1cd") returned 4 [0285.912] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0285.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0285.912] lstrlenW (lpString=".jpg") returned 4 [0285.912] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0285.912] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0285.912] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0285.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0286.706] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=4608) returned 1 [0286.706] CloseHandle (hObject=0x1dc) returned 1 [0286.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0286.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.707] lstrlenW (lpString=".doc") returned 4 [0286.707] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.707] lstrlenW (lpString=".docx") returned 5 [0286.707] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.707] lstrlenW (lpString=".pdf") returned 4 [0286.707] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.707] lstrlenW (lpString=".xls") returned 4 [0286.707] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.707] lstrlenW (lpString=".xlsx") returned 5 [0286.707] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.707] lstrlenW (lpString=".ppt") returned 4 [0286.707] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.707] lstrlenW (lpString=".zip") returned 4 [0286.707] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.707] lstrlenW (lpString=".rar") returned 4 [0286.707] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.707] lstrlenW (lpString=".bz2") returned 4 [0286.707] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.707] lstrlenW (lpString=".7z") returned 3 [0286.707] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.707] lstrlenW (lpString=".dbf") returned 4 [0286.707] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.708] lstrlenW (lpString=".1cd") returned 4 [0286.708] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.708] lstrlenW (lpString=".jpg") returned 4 [0286.708] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.708] lstrlenW (lpString=".doc") returned 4 [0286.708] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.708] lstrlenW (lpString=".docx") returned 5 [0286.708] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.708] lstrlenW (lpString=".pdf") returned 4 [0286.708] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.708] lstrlenW (lpString=".xls") returned 4 [0286.708] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.708] lstrlenW (lpString=".xlsx") returned 5 [0286.708] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.708] lstrlenW (lpString=".ppt") returned 4 [0286.708] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.708] lstrlenW (lpString=".zip") returned 4 [0286.708] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.709] lstrlenW (lpString=".rar") returned 4 [0286.709] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.709] lstrlenW (lpString=".bz2") returned 4 [0286.709] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.709] lstrlenW (lpString=".7z") returned 3 [0286.709] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.709] lstrlenW (lpString=".dbf") returned 4 [0286.709] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.709] lstrlenW (lpString=".1cd") returned 4 [0286.709] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0286.709] lstrlenW (lpString=".jpg") returned 4 [0286.709] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.710] lstrcmpiW (lpString1=".mui", lpString2=".drweb") returned 1 [0286.710] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0286.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0286.739] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=3584) returned 1 [0286.739] CloseHandle (hObject=0x1e4) returned 1 [0286.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0286.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0286.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.739] lstrlenW (lpString=".doc") returned 4 [0286.739] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.739] lstrlenW (lpString=".docx") returned 5 [0286.740] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.740] lstrlenW (lpString=".pdf") returned 4 [0286.740] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.740] lstrlenW (lpString=".xls") returned 4 [0286.740] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.740] lstrlenW (lpString=".xlsx") returned 5 [0286.740] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.740] lstrlenW (lpString=".ppt") returned 4 [0286.740] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.740] lstrlenW (lpString=".zip") returned 4 [0286.740] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.740] lstrlenW (lpString=".rar") returned 4 [0286.740] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.740] lstrlenW (lpString=".bz2") returned 4 [0286.740] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.740] lstrlenW (lpString=".7z") returned 3 [0286.740] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.740] lstrlenW (lpString=".dbf") returned 4 [0286.740] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.741] lstrlenW (lpString=".1cd") returned 4 [0286.741] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.741] lstrlenW (lpString=".jpg") returned 4 [0286.741] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.741] lstrlenW (lpString=".doc") returned 4 [0286.741] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0286.741] lstrlenW (lpString=".docx") returned 5 [0286.741] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0286.741] lstrlenW (lpString=".pdf") returned 4 [0286.741] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0286.741] lstrlenW (lpString=".xls") returned 4 [0286.741] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0286.741] lstrlenW (lpString=".xlsx") returned 5 [0286.741] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0286.741] lstrlenW (lpString=".ppt") returned 4 [0286.741] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0286.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.741] lstrlenW (lpString=".zip") returned 4 [0286.741] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0286.741] lstrlenW (lpString=".rar") returned 4 [0286.741] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0286.741] lstrlenW (lpString=".bz2") returned 4 [0286.742] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0286.742] lstrlenW (lpString=".7z") returned 3 [0286.742] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0286.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.742] lstrlenW (lpString=".dbf") returned 4 [0286.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0286.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.742] lstrlenW (lpString=".1cd") returned 4 [0286.742] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0286.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 72 [0286.742] lstrlenW (lpString=".jpg") returned 4 [0286.742] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0286.742] lstrcmpiW (lpString1=".DLL", lpString2=".drweb") returned -1 [0286.742] lstrlenW (lpString="ACERECR.DLL") returned 11 [0286.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.824] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=20944) returned 1 [0286.824] CloseHandle (hObject=0x1f8) returned 1 [0286.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0286.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[dr.web24@aol.com].drweb")) returned 0xffffffff [0286.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0286.824] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0286.824] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0286.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[dr.web24@aol.com].drweb" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[dr.web24@aol.com].drweb"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0287.285] GetLastError () returned 0x0 [0287.285] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x51d0, lpOverlapped=0x0) returned 1 [0287.570] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0287.575] ReadFile (in: hFile=0x1f8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0287.575] WriteFile (in: hFile=0x174, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0287.575] SetEndOfFile (hFile=0x174) Thread: id = 17 os_tid = 0x630 [0260.805] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39106c0 [0260.805] lstrlenW (lpString="C:") returned 2 [0260.805] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x32c010 [0260.806] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0260.806] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0260.806] lstrlenW (lpString="$Recycle.Bin") returned 12 [0260.806] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0260.806] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39206c8 [0260.806] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0260.806] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331048 [0260.807] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.807] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0260.807] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0260.807] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0260.807] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0260.807] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0260.807] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.807] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0260.807] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331088 [0260.808] FindNextFileW (in: hFindFile=0x331088, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.808] FindNextFileW (in: hFindFile=0x331088, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0260.808] lstrlenW (lpString="desktop.ini") returned 11 [0260.808] lstrlenW (lpString=".1cd") returned 4 [0260.808] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0260.808] lstrlenW (lpString=".3ds") returned 4 [0260.808] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0260.808] lstrlenW (lpString=".3fr") returned 4 [0260.808] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0260.808] lstrlenW (lpString=".3g2") returned 4 [0260.808] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0260.808] lstrlenW (lpString=".3gp") returned 4 [0260.808] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0260.808] lstrlenW (lpString=".7z") returned 3 [0260.808] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0260.808] lstrlenW (lpString=".accda") returned 6 [0260.808] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0260.808] lstrlenW (lpString=".accdb") returned 6 [0260.808] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0260.808] lstrlenW (lpString=".accdc") returned 6 [0260.808] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0260.809] lstrlenW (lpString=".accde") returned 6 [0260.809] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0260.809] lstrlenW (lpString=".accdt") returned 6 [0260.809] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0260.809] lstrlenW (lpString=".accdw") returned 6 [0260.809] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0260.809] lstrlenW (lpString=".adb") returned 4 [0260.809] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".adp") returned 4 [0260.809] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".ai") returned 3 [0260.809] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0260.809] lstrlenW (lpString=".ai3") returned 4 [0260.809] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".ai4") returned 4 [0260.809] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".ai5") returned 4 [0260.809] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".ai6") returned 4 [0260.809] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".ai7") returned 4 [0260.809] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".ai8") returned 4 [0260.809] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".anim") returned 5 [0260.809] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0260.809] lstrlenW (lpString=".arw") returned 4 [0260.809] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0260.809] lstrlenW (lpString=".as") returned 3 [0260.810] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0260.810] lstrlenW (lpString=".asa") returned 4 [0260.810] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".asc") returned 4 [0260.810] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".ascx") returned 5 [0260.810] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0260.810] lstrlenW (lpString=".asm") returned 4 [0260.810] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".asmx") returned 5 [0260.810] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0260.810] lstrlenW (lpString=".asp") returned 4 [0260.810] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".aspx") returned 5 [0260.810] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0260.810] lstrlenW (lpString=".asr") returned 4 [0260.810] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".asx") returned 4 [0260.810] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".avi") returned 4 [0260.810] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".avs") returned 4 [0260.810] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".backup") returned 7 [0260.810] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0260.810] lstrlenW (lpString=".bak") returned 4 [0260.810] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".bay") returned 4 [0260.810] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0260.810] lstrlenW (lpString=".bd") returned 3 [0260.811] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0260.811] lstrlenW (lpString=".bin") returned 4 [0260.811] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".bmp") returned 4 [0260.811] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".bz2") returned 4 [0260.811] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".c") returned 2 [0260.811] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0260.811] lstrlenW (lpString=".cdr") returned 4 [0260.811] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".cer") returned 4 [0260.811] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".cf") returned 3 [0260.811] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0260.811] lstrlenW (lpString=".cfc") returned 4 [0260.811] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".cfm") returned 4 [0260.811] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".cfml") returned 5 [0260.811] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0260.811] lstrlenW (lpString=".cfu") returned 4 [0260.811] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".chm") returned 4 [0260.811] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".cin") returned 4 [0260.811] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0260.811] lstrlenW (lpString=".class") returned 6 [0260.811] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0260.811] lstrlenW (lpString=".clx") returned 4 [0260.812] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".config") returned 7 [0260.812] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0260.812] lstrlenW (lpString=".cpp") returned 4 [0260.812] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".cr2") returned 4 [0260.812] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".crt") returned 4 [0260.812] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".crw") returned 4 [0260.812] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".cs") returned 3 [0260.812] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0260.812] lstrlenW (lpString=".css") returned 4 [0260.812] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".csv") returned 4 [0260.812] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".cub") returned 4 [0260.812] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".dae") returned 4 [0260.812] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".dat") returned 4 [0260.812] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".db") returned 3 [0260.812] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0260.812] lstrlenW (lpString=".dbf") returned 4 [0260.812] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".dbx") returned 4 [0260.812] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0260.812] lstrlenW (lpString=".dc3") returned 4 [0260.813] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".dcm") returned 4 [0260.813] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".dcr") returned 4 [0260.813] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".der") returned 4 [0260.813] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".dib") returned 4 [0260.813] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".dic") returned 4 [0260.813] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".dif") returned 4 [0260.813] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".divx") returned 5 [0260.813] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0260.813] lstrlenW (lpString=".djvu") returned 5 [0260.813] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0260.813] lstrlenW (lpString=".dng") returned 4 [0260.813] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".doc") returned 4 [0260.813] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".docm") returned 5 [0260.813] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0260.813] lstrlenW (lpString=".docx") returned 5 [0260.813] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0260.813] lstrlenW (lpString=".dot") returned 4 [0260.813] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0260.813] lstrlenW (lpString=".dotm") returned 5 [0260.813] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0260.813] lstrlenW (lpString=".dotx") returned 5 [0260.814] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0260.814] lstrlenW (lpString=".dpx") returned 4 [0260.814] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".dqy") returned 4 [0260.814] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".dsn") returned 4 [0260.814] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".dt") returned 3 [0260.814] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0260.814] lstrlenW (lpString=".dtd") returned 4 [0260.814] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".dwg") returned 4 [0260.814] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".dwt") returned 4 [0260.814] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".dx") returned 3 [0260.814] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0260.814] lstrlenW (lpString=".dxf") returned 4 [0260.814] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".edml") returned 5 [0260.814] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0260.814] lstrlenW (lpString=".efd") returned 4 [0260.814] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".elf") returned 4 [0260.814] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".emf") returned 4 [0260.814] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".emz") returned 4 [0260.814] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0260.814] lstrlenW (lpString=".epf") returned 4 [0260.815] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".eps") returned 4 [0260.815] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".epsf") returned 5 [0260.815] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0260.815] lstrlenW (lpString=".epsp") returned 5 [0260.815] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0260.815] lstrlenW (lpString=".erf") returned 4 [0260.815] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".exr") returned 4 [0260.815] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".f4v") returned 4 [0260.815] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".fido") returned 5 [0260.815] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0260.815] lstrlenW (lpString=".flm") returned 4 [0260.815] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".flv") returned 4 [0260.815] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".frm") returned 4 [0260.815] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".fxg") returned 4 [0260.815] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".geo") returned 4 [0260.815] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".gif") returned 4 [0260.815] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0260.815] lstrlenW (lpString=".grs") returned 4 [0260.815] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".gz") returned 3 [0260.816] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0260.816] lstrlenW (lpString=".h") returned 2 [0260.816] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0260.816] lstrlenW (lpString=".hdr") returned 4 [0260.816] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".hpp") returned 4 [0260.816] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".hta") returned 4 [0260.816] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".htc") returned 4 [0260.816] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".htm") returned 4 [0260.816] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".html") returned 5 [0260.816] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0260.816] lstrlenW (lpString=".icb") returned 4 [0260.816] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".ics") returned 4 [0260.816] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".iff") returned 4 [0260.816] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".inc") returned 4 [0260.816] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0260.816] lstrlenW (lpString=".indd") returned 5 [0260.816] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0260.816] lstrlenW (lpString=".ini") returned 4 [0260.816] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0260.816] lstrlenW (lpString="desktop.ini") returned 11 [0260.816] lstrlenW (lpString=".drweb") returned 6 [0260.816] lstrcmpiW (lpString1=".drweb", lpString2="op.ini") returned -1 [0260.817] lstrlenW (lpString="desktop.ini") returned 11 [0260.817] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0260.817] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0260.817] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0260.817] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0260.817] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0260.817] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0260.817] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0260.817] lstrcmpiW (lpString1="expIorer32.exe", lpString2="desktop.ini") returned 1 [0260.817] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0260.817] FindNextFileW (in: hFindFile=0x331088, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0260.817] FindClose (in: hFindFile=0x331088 | out: hFindFile=0x331088) returned 1 [0260.817] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.817] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0260.817] FindClose (in: hFindFile=0x331048 | out: hFindFile=0x331048) returned 1 [0260.817] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39206c8 | out: hHeap=0x2e0000) returned 1 [0260.817] FindNextFileW (in: hFindFile=0x32c010, lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0260.817] lstrlenW (lpString="C:\\Boot") returned 7 [0260.818] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0260.818] lstrlenW (lpString="Boot") returned 4 [0260.818] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0260.818] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39206c8 [0260.818] lstrlenW (lpString="C:\\Boot") returned 7 [0260.818] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331048 [0260.818] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.818] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0260.818] lstrlenW (lpString="BCD") returned 3 [0260.818] lstrlenW (lpString=".1cd") returned 4 [0260.818] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0260.818] lstrlenW (lpString=".3ds") returned 4 [0260.818] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0260.818] lstrlenW (lpString=".3fr") returned 4 [0260.818] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0260.818] lstrlenW (lpString=".3g2") returned 4 [0260.818] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0260.818] lstrlenW (lpString=".3gp") returned 4 [0260.818] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0260.818] lstrlenW (lpString=".7z") returned 3 [0260.818] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0260.818] lstrlenW (lpString=".accda") returned 6 [0260.818] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".accdb") returned 6 [0260.819] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".accdc") returned 6 [0260.819] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".accde") returned 6 [0260.819] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".accdt") returned 6 [0260.819] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".accdw") returned 6 [0260.819] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".adb") returned 4 [0260.819] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".adp") returned 4 [0260.819] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".ai") returned 3 [0260.819] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0260.819] lstrlenW (lpString=".ai3") returned 4 [0260.819] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".ai4") returned 4 [0260.819] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".ai5") returned 4 [0260.819] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".ai6") returned 4 [0260.819] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".ai7") returned 4 [0260.819] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".ai8") returned 4 [0260.819] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0260.819] lstrlenW (lpString=".anim") returned 5 [0260.819] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".arw") returned 4 [0260.820] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".as") returned 3 [0260.820] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0260.820] lstrlenW (lpString=".asa") returned 4 [0260.820] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".asc") returned 4 [0260.820] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".ascx") returned 5 [0260.820] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".asm") returned 4 [0260.820] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".asmx") returned 5 [0260.820] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".asp") returned 4 [0260.820] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".aspx") returned 5 [0260.820] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".asr") returned 4 [0260.820] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".asx") returned 4 [0260.820] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".avi") returned 4 [0260.820] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0260.820] lstrlenW (lpString=".avs") returned 4 [0260.821] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".backup") returned 7 [0260.821] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".bak") returned 4 [0260.821] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".bay") returned 4 [0260.821] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".bd") returned 3 [0260.821] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0260.821] lstrlenW (lpString=".bin") returned 4 [0260.821] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".bmp") returned 4 [0260.821] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".bz2") returned 4 [0260.821] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".c") returned 2 [0260.821] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0260.821] lstrlenW (lpString=".cdr") returned 4 [0260.821] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".cer") returned 4 [0260.821] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".cf") returned 3 [0260.821] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0260.821] lstrlenW (lpString=".cfc") returned 4 [0260.821] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".cfm") returned 4 [0260.821] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0260.821] lstrlenW (lpString=".cfml") returned 5 [0260.821] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".cfu") returned 4 [0260.822] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".chm") returned 4 [0260.822] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".cin") returned 4 [0260.822] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".class") returned 6 [0260.822] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".clx") returned 4 [0260.822] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".config") returned 7 [0260.822] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".cpp") returned 4 [0260.822] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".cr2") returned 4 [0260.822] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".crt") returned 4 [0260.822] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".crw") returned 4 [0260.822] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".cs") returned 3 [0260.822] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0260.822] lstrlenW (lpString=".css") returned 4 [0260.822] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".csv") returned 4 [0260.822] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".cub") returned 4 [0260.822] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0260.822] lstrlenW (lpString=".dae") returned 4 [0260.822] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dat") returned 4 [0260.823] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".db") returned 3 [0260.823] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0260.823] lstrlenW (lpString=".dbf") returned 4 [0260.823] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dbx") returned 4 [0260.823] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dc3") returned 4 [0260.823] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dcm") returned 4 [0260.823] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dcr") returned 4 [0260.823] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".der") returned 4 [0260.823] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dib") returned 4 [0260.823] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dic") returned 4 [0260.823] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dif") returned 4 [0260.823] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".divx") returned 5 [0260.823] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".djvu") returned 5 [0260.823] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".dng") returned 4 [0260.823] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".doc") returned 4 [0260.823] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".docm") returned 5 [0260.823] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0260.823] lstrlenW (lpString=".docx") returned 5 [0260.824] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dot") returned 4 [0260.824] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dotm") returned 5 [0260.824] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dotx") returned 5 [0260.824] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dpx") returned 4 [0260.824] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dqy") returned 4 [0260.824] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dsn") returned 4 [0260.824] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dt") returned 3 [0260.824] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0260.824] lstrlenW (lpString=".dtd") returned 4 [0260.824] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dwg") returned 4 [0260.824] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dwt") returned 4 [0260.824] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".dx") returned 3 [0260.824] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0260.824] lstrlenW (lpString=".dxf") returned 4 [0260.824] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".edml") returned 5 [0260.824] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".efd") returned 4 [0260.824] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0260.824] lstrlenW (lpString=".elf") returned 4 [0260.825] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".emf") returned 4 [0260.825] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".emz") returned 4 [0260.825] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".epf") returned 4 [0260.825] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".eps") returned 4 [0260.825] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".epsf") returned 5 [0260.825] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".epsp") returned 5 [0260.825] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".erf") returned 4 [0260.825] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".exr") returned 4 [0260.825] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".f4v") returned 4 [0260.825] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0260.825] lstrlenW (lpString=".fido") returned 5 [0260.825] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0260.826] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.826] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.872] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.872] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.872] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.872] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.872] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0260.872] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.872] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.873] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.873] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.873] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.873] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.873] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0260.873] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.873] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.873] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.873] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.873] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.873] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.874] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0260.874] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.874] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.874] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.874] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.874] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.874] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.874] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0260.874] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.874] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.874] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.874] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.875] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.875] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.875] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0260.875] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.875] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.875] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.875] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.875] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.875] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.875] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0260.876] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.876] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.876] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.876] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.876] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.876] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.876] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0260.876] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.876] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.876] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.876] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0260.877] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.877] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.877] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0260.877] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.877] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.877] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.877] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.877] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.877] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.877] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0260.877] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.877] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.877] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.878] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.878] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.878] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.878] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0260.878] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.878] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.878] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.878] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.878] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.878] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.878] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0260.878] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.878] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.878] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.879] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.879] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.879] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.879] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0260.879] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.879] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.879] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.879] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.879] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.879] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.879] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0260.879] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.879] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.879] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.880] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.880] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.880] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.880] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0260.880] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.880] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.880] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.880] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.880] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.880] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.880] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0260.880] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0260.880] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.880] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.881] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.881] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.881] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0260.881] FindNextFileW (in: hFindFile=0x331048, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0260.881] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39306d0 [0263.878] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.878] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0263.878] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0263.878] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0263.881] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0263.881] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f03870 [0263.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0263.977] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.977] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0263.977] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0263.977] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0263.977] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0263.978] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f03870 [0263.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0264.048] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.048] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0264.049] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0264.050] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0264.050] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0264.050] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f03870 [0264.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0264.050] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.050] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0264.051] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0264.051] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f03870 | out: hHeap=0x2e0000) returned 1 [0264.051] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0264.051] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f03870 [0264.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0264.051] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.051] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0264.051] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.177] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.177] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.177] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.177] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.178] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0264.178] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.179] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.179] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.179] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.179] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.179] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0264.179] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.180] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.180] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.180] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.180] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.180] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0264.180] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.180] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.180] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.181] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.181] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.181] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0264.181] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.198] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.198] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.199] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.199] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.199] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0264.199] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.199] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.199] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.199] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.200] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.200] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0264.200] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.206] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.206] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0264.207] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.208] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.208] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0264.208] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.208] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.209] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0264.209] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.209] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f14880 | out: hHeap=0x2e0000) returned 1 [0264.209] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0264.209] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f14880 [0264.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0264.690] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.690] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0267.217] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.217] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.217] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0267.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.227] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.228] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0267.228] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.228] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.228] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0267.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.232] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0267.232] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.232] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.232] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0267.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.233] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0267.233] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.233] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.233] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0267.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.234] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.234] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0267.235] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.235] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0267.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.235] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.235] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0267.235] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.236] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.236] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0267.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.239] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.239] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.239] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.239] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.239] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0267.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.240] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.240] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.241] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.241] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.241] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0267.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.242] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.242] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.242] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.242] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.242] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0267.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.243] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.243] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.243] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.243] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.243] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0267.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.244] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.244] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.245] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.245] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.245] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0267.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.245] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.245] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.245] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.246] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.246] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0267.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.247] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.247] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.247] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.247] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.247] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0267.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.248] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.248] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.248] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.249] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.249] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0267.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.250] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.250] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.250] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.250] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.250] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0267.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.251] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.251] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.252] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.252] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.252] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0267.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.253] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.253] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.254] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.254] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.254] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0267.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.255] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.255] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.255] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.255] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.255] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0267.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.256] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.256] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.257] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.257] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.257] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0267.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.257] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.257] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.257] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.258] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.258] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0267.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.267] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.267] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.268] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.268] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.268] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0267.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.285] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.285] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.285] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.286] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.286] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0267.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.286] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.286] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.286] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.286] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.286] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0267.286] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0267.286] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f6c8b0 | out: hHeap=0x2e0000) returned 1 [0267.289] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0267.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.299] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.299] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0267.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.300] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.300] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0267.300] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.301] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.301] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0267.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.301] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.301] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0267.302] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.302] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.302] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0267.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.302] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.302] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0267.302] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.302] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.302] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0267.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.303] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.303] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0267.303] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.303] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.303] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0267.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.772] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.777] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0267.777] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.777] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.777] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0267.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.777] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.777] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0267.778] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.778] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.778] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0267.778] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0267.778] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f6c8b0 | out: hHeap=0x2e0000) returned 1 [0267.778] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0267.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.778] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.778] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0267.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.779] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.779] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0267.779] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.779] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f6c8b0 | out: hHeap=0x2e0000) returned 1 [0267.779] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0267.779] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0267.779] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0267.779] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0267.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.779] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.779] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0267.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.779] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.779] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0267.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x340ee18 | out: lpFindFileData=0x340ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02b48 [0267.786] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x340ee18 | out: lpFindFileData=0x340ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x340ee18 | out: lpFindFileData=0x340ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0267.786] FindClose (in: hFindFile=0x3f02b48 | out: hFindFile=0x3f02b48) returned 1 [0267.786] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f7c8b8 | out: hHeap=0x2e0000) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0267.786] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.786] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f6c8b0 | out: hHeap=0x2e0000) returned 1 [0267.786] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0267.786] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0267.787] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0267.787] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0267.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.792] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.792] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0267.792] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0267.792] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0267.792] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0267.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.793] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.793] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0267.793] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0267.793] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0267.793] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0267.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.794] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.794] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0267.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.807] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.807] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0268.183] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.183] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0268.184] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0268.184] lstrlenW (lpString=".3ds") returned 4 [0268.184] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0268.184] lstrlenW (lpString=".3fr") returned 4 [0268.184] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0268.184] lstrlenW (lpString=".3g2") returned 4 [0268.184] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0268.184] lstrlenW (lpString=".3gp") returned 4 [0268.184] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0268.184] lstrlenW (lpString=".7z") returned 3 [0268.184] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0268.184] lstrlenW (lpString=".accda") returned 6 [0268.184] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0268.184] lstrlenW (lpString=".accdb") returned 6 [0268.184] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0268.184] lstrlenW (lpString=".accdc") returned 6 [0268.184] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0268.184] lstrlenW (lpString=".accde") returned 6 [0268.184] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0268.184] lstrlenW (lpString=".accdt") returned 6 [0268.184] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0268.184] lstrlenW (lpString=".accdw") returned 6 [0268.184] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0268.184] lstrlenW (lpString=".adb") returned 4 [0268.184] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0268.184] lstrlenW (lpString=".adp") returned 4 [0268.185] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ai") returned 3 [0268.185] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0268.185] lstrlenW (lpString=".ai3") returned 4 [0268.185] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ai4") returned 4 [0268.185] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ai5") returned 4 [0268.185] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ai6") returned 4 [0268.185] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ai7") returned 4 [0268.185] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ai8") returned 4 [0268.185] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".anim") returned 5 [0268.185] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0268.185] lstrlenW (lpString=".arw") returned 4 [0268.185] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".as") returned 3 [0268.185] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0268.185] lstrlenW (lpString=".asa") returned 4 [0268.185] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".asc") returned 4 [0268.185] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0268.185] lstrlenW (lpString=".ascx") returned 5 [0268.185] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0268.185] lstrlenW (lpString=".asm") returned 4 [0268.186] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".asmx") returned 5 [0268.186] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0268.186] lstrlenW (lpString=".asp") returned 4 [0268.186] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".aspx") returned 5 [0268.186] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0268.186] lstrlenW (lpString=".asr") returned 4 [0268.186] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".asx") returned 4 [0268.186] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".avi") returned 4 [0268.186] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".avs") returned 4 [0268.186] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".backup") returned 7 [0268.186] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0268.186] lstrlenW (lpString=".bak") returned 4 [0268.186] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".bay") returned 4 [0268.186] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".bd") returned 3 [0268.186] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0268.186] lstrlenW (lpString=".bin") returned 4 [0268.186] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".bmp") returned 4 [0268.186] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".bz2") returned 4 [0268.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0268.186] lstrlenW (lpString=".c") returned 2 [0268.186] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0268.186] lstrlenW (lpString=".cdr") returned 4 [0268.186] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cer") returned 4 [0268.187] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cf") returned 3 [0268.187] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0268.187] lstrlenW (lpString=".cfc") returned 4 [0268.187] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cfm") returned 4 [0268.187] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cfml") returned 5 [0268.187] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0268.187] lstrlenW (lpString=".cfu") returned 4 [0268.187] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".chm") returned 4 [0268.187] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cin") returned 4 [0268.187] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".class") returned 6 [0268.187] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0268.187] lstrlenW (lpString=".clx") returned 4 [0268.187] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".config") returned 7 [0268.187] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0268.187] lstrlenW (lpString=".cpp") returned 4 [0268.187] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cr2") returned 4 [0268.187] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".crt") returned 4 [0268.187] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".crw") returned 4 [0268.187] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0268.187] lstrlenW (lpString=".cs") returned 3 [0268.188] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0268.188] lstrlenW (lpString=".css") returned 4 [0268.188] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".csv") returned 4 [0268.188] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".cub") returned 4 [0268.188] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dae") returned 4 [0268.188] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dat") returned 4 [0268.188] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".db") returned 3 [0268.188] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0268.188] lstrlenW (lpString=".dbf") returned 4 [0268.188] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dbx") returned 4 [0268.188] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dc3") returned 4 [0268.188] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dcm") returned 4 [0268.188] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dcr") returned 4 [0268.188] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".der") returned 4 [0268.188] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dib") returned 4 [0268.188] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0268.188] lstrlenW (lpString=".dic") returned 4 [0268.188] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0268.189] lstrlenW (lpString=".dif") returned 4 [0268.189] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0268.189] lstrlenW (lpString=".divx") returned 5 [0268.189] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0268.189] lstrlenW (lpString=".djvu") returned 5 [0268.189] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0268.189] lstrlenW (lpString=".dng") returned 4 [0268.189] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0268.189] lstrlenW (lpString=".doc") returned 4 [0268.189] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0268.189] lstrlenW (lpString=".docm") returned 5 [0268.189] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0268.189] lstrlenW (lpString=".docx") returned 5 [0268.189] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0268.189] lstrlenW (lpString=".dot") returned 4 [0268.189] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0268.189] lstrlenW (lpString=".dotm") returned 5 [0268.189] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0268.189] lstrlenW (lpString=".dotx") returned 5 [0268.190] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0268.190] lstrlenW (lpString=".dpx") returned 4 [0268.190] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".dqy") returned 4 [0268.190] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".dsn") returned 4 [0268.190] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".dt") returned 3 [0268.190] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0268.190] lstrlenW (lpString=".dtd") returned 4 [0268.190] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".dwg") returned 4 [0268.190] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".dwt") returned 4 [0268.190] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".dx") returned 3 [0268.190] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0268.190] lstrlenW (lpString=".dxf") returned 4 [0268.190] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".edml") returned 5 [0268.190] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0268.190] lstrlenW (lpString=".efd") returned 4 [0268.190] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".elf") returned 4 [0268.190] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".emf") returned 4 [0268.190] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0268.190] lstrlenW (lpString=".emz") returned 4 [0268.190] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".epf") returned 4 [0268.191] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".eps") returned 4 [0268.191] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".epsf") returned 5 [0268.191] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0268.191] lstrlenW (lpString=".epsp") returned 5 [0268.191] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0268.191] lstrlenW (lpString=".erf") returned 4 [0268.191] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".exr") returned 4 [0268.191] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".f4v") returned 4 [0268.191] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".fido") returned 5 [0268.191] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0268.191] lstrlenW (lpString=".flm") returned 4 [0268.191] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".flv") returned 4 [0268.191] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".frm") returned 4 [0268.191] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".fxg") returned 4 [0268.191] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".geo") returned 4 [0268.191] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0268.191] lstrlenW (lpString=".gif") returned 4 [0268.191] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".grs") returned 4 [0268.192] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".gz") returned 3 [0268.192] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0268.192] lstrlenW (lpString=".h") returned 2 [0268.192] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0268.192] lstrlenW (lpString=".hdr") returned 4 [0268.192] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".hpp") returned 4 [0268.192] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".hta") returned 4 [0268.192] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".htc") returned 4 [0268.192] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".htm") returned 4 [0268.192] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0268.192] lstrlenW (lpString=".html") returned 5 [0268.192] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0268.193] lstrlenW (lpString=".icb") returned 4 [0268.193] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".ics") returned 4 [0268.193] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".iff") returned 4 [0268.193] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".inc") returned 4 [0268.193] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".indd") returned 5 [0268.193] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0268.193] lstrlenW (lpString=".ini") returned 4 [0268.193] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".iqy") returned 4 [0268.193] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".j2c") returned 4 [0268.193] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".j2k") returned 4 [0268.193] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".java") returned 5 [0268.193] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0268.193] lstrlenW (lpString=".jp2") returned 4 [0268.193] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".jpc") returned 4 [0268.193] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".jpe") returned 4 [0268.193] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".jpeg") returned 5 [0268.193] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0268.193] lstrlenW (lpString=".jpf") returned 4 [0268.193] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".jpg") returned 4 [0268.193] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0268.193] lstrlenW (lpString=".jpx") returned 4 [0268.193] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".js") returned 3 [0268.194] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0268.194] lstrlenW (lpString=".jsf") returned 4 [0268.194] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".json") returned 5 [0268.194] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0268.194] lstrlenW (lpString=".jsp") returned 4 [0268.194] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".kdc") returned 4 [0268.194] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".kmz") returned 4 [0268.194] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".kwm") returned 4 [0268.194] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".lasso") returned 6 [0268.194] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0268.194] lstrlenW (lpString=".lbi") returned 4 [0268.194] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".lgf") returned 4 [0268.194] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".lgp") returned 4 [0268.194] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".log") returned 4 [0268.194] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0268.194] lstrlenW (lpString=".m1v") returned 4 [0268.194] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".m4a") returned 4 [0268.195] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".m4v") returned 4 [0268.195] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".max") returned 4 [0268.195] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".md") returned 3 [0268.195] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0268.195] lstrlenW (lpString=".mda") returned 4 [0268.195] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mdb") returned 4 [0268.195] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mde") returned 4 [0268.195] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mdf") returned 4 [0268.195] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mdw") returned 4 [0268.195] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mef") returned 4 [0268.195] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mft") returned 4 [0268.195] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mfw") returned 4 [0268.195] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0268.195] lstrlenW (lpString=".mht") returned 4 [0268.196] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mhtml") returned 6 [0268.196] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0268.196] lstrlenW (lpString=".mka") returned 4 [0268.196] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mkidx") returned 6 [0268.196] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0268.196] lstrlenW (lpString=".mkv") returned 4 [0268.196] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mos") returned 4 [0268.196] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mov") returned 4 [0268.196] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mp3") returned 4 [0268.196] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mp4") returned 4 [0268.196] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mpeg") returned 5 [0268.196] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0268.196] lstrlenW (lpString=".mpg") returned 4 [0268.196] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mpv") returned 4 [0268.196] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0268.196] lstrlenW (lpString=".mrw") returned 4 [0268.196] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0268.197] lstrlenW (lpString=".msg") returned 4 [0268.197] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0268.197] lstrlenW (lpString=".mxl") returned 4 [0268.197] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".myd") returned 4 [0268.197] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".myi") returned 4 [0268.197] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".nef") returned 4 [0268.197] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".nrw") returned 4 [0268.197] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".obj") returned 4 [0268.197] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".odb") returned 4 [0268.197] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".odc") returned 4 [0268.197] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0268.197] lstrlenW (lpString=".odm") returned 4 [0268.198] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".odp") returned 4 [0268.198] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".ods") returned 4 [0268.198] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".oft") returned 4 [0268.198] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".one") returned 4 [0268.198] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".onepkg") returned 7 [0268.198] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0268.198] lstrlenW (lpString=".onetoc2") returned 8 [0268.198] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0268.198] lstrlenW (lpString=".opt") returned 4 [0268.198] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".oqy") returned 4 [0268.198] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".orf") returned 4 [0268.198] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".p12") returned 4 [0268.198] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".p7b") returned 4 [0268.198] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".p7c") returned 4 [0268.198] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".pam") returned 4 [0268.198] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".pbm") returned 4 [0268.198] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".pct") returned 4 [0268.198] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".pcx") returned 4 [0268.198] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0268.198] lstrlenW (lpString=".pdd") returned 4 [0268.198] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pdf") returned 4 [0268.199] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pdp") returned 4 [0268.199] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pef") returned 4 [0268.199] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pem") returned 4 [0268.199] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pff") returned 4 [0268.199] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pfm") returned 4 [0268.199] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pfx") returned 4 [0268.199] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pgm") returned 4 [0268.199] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".php") returned 4 [0268.199] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".php3") returned 5 [0268.199] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0268.199] lstrlenW (lpString=".php4") returned 5 [0268.199] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0268.199] lstrlenW (lpString=".php5") returned 5 [0268.199] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0268.199] lstrlenW (lpString=".phtml") returned 6 [0268.199] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0268.199] lstrlenW (lpString=".pict") returned 5 [0268.199] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0268.199] lstrlenW (lpString=".pl") returned 3 [0268.199] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0268.199] lstrlenW (lpString=".pls") returned 4 [0268.199] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0268.199] lstrlenW (lpString=".pm") returned 3 [0268.200] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0268.200] lstrlenW (lpString=".png") returned 4 [0268.200] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".pnm") returned 4 [0268.200] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".pot") returned 4 [0268.200] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".potm") returned 5 [0268.200] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0268.200] lstrlenW (lpString=".potx") returned 5 [0268.200] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0268.200] lstrlenW (lpString=".ppa") returned 4 [0268.200] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".ppam") returned 5 [0268.200] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0268.200] lstrlenW (lpString=".ppm") returned 4 [0268.200] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".pps") returned 4 [0268.200] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".ppsm") returned 5 [0268.200] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0268.200] lstrlenW (lpString=".ppt") returned 4 [0268.200] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".pptm") returned 5 [0268.200] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0268.200] lstrlenW (lpString=".pptx") returned 5 [0268.200] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0268.200] lstrlenW (lpString=".prn") returned 4 [0268.200] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".ps") returned 3 [0268.200] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0268.200] lstrlenW (lpString=".psb") returned 4 [0268.200] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".psd") returned 4 [0268.200] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0268.200] lstrlenW (lpString=".pst") returned 4 [0268.201] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".ptx") returned 4 [0268.201] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".pub") returned 4 [0268.201] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".pwm") returned 4 [0268.201] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".pxr") returned 4 [0268.201] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".py") returned 3 [0268.201] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0268.201] lstrlenW (lpString=".qt") returned 3 [0268.201] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0268.201] lstrlenW (lpString=".r3d") returned 4 [0268.201] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".raf") returned 4 [0268.201] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".rar") returned 4 [0268.201] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".raw") returned 4 [0268.201] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".rdf") returned 4 [0268.201] lstrcmpiW (lpString1=".rdf", lpString2=".mui") returned 1 [0268.201] lstrlenW (lpString=".rgbe") returned 5 [0268.201] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0268.202] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0268.202] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0268.202] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0268.202] FindClose (in: hFindFile=0x3f02b08 | out: hFindFile=0x3f02b08) returned 1 [0268.203] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0268.213] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0268.213] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0268.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02b08 [0268.218] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.218] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0268.218] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3fd48d8 [0268.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0268.218] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.218] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0268.218] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0268.219] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0268.219] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0268.219] FindClose (in: hFindFile=0x3f02b08 | out: hFindFile=0x3f02b08) returned 1 [0268.219] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0268.219] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0268.219] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0268.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02b08 [0268.261] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.261] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0268.261] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3fd48d8 [0268.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0268.262] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.262] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0268.262] FindClose (in: hFindFile=0x3f02a48 | out: hFindFile=0x3f02a48) returned 1 [0268.262] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3fd48d8 | out: hHeap=0x2e0000) returned 1 [0268.262] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0268.263] FindClose (in: hFindFile=0x3f02b08 | out: hFindFile=0x3f02b08) returned 1 [0268.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0268.263] FindNextFileW (in: hFindFile=0x3f029c8, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0268.263] FindClose (in: hFindFile=0x3f029c8 | out: hFindFile=0x3f029c8) returned 1 [0268.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39306d0 | out: hHeap=0x2e0000) returned 1 [0268.263] FindNextFileW (in: hFindFile=0x3f02988, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0268.263] FindClose (in: hFindFile=0x3f02988 | out: hFindFile=0x3f02988) returned 1 [0268.263] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39206c8 | out: hHeap=0x2e0000) returned 1 [0268.263] FindNextFileW (in: hFindFile=0x3f02948, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0268.263] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0268.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xb79a4ae0, ftLastAccessTime.dwHighDateTime=0x1d5097a, ftLastWriteTime.dwLowDateTime=0xb79a4ae0, ftLastWriteTime.dwHighDateTime=0x1d5097a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02988 [0268.264] FindNextFileW (in: hFindFile=0x3f02988, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xb79a4ae0, ftLastAccessTime.dwHighDateTime=0x1d5097a, ftLastWriteTime.dwLowDateTime=0xb79a4ae0, ftLastWriteTime.dwHighDateTime=0x1d5097a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.264] FindNextFileW (in: hFindFile=0x3f02988, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0268.264] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3fd48d8 Thread: id = 18 os_tid = 0x68c [0260.827] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39406d8 [0260.827] lstrlenW (lpString="C:") returned 2 [0260.827] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x331088 [0260.827] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0260.827] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0260.827] lstrlenW (lpString="$Recycle.Bin") returned 12 [0260.827] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0260.827] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39506e0 [0260.828] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0260.828] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3310c8 [0260.828] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.828] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0260.828] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0260.828] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0260.828] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0260.828] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0260.828] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.829] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0260.829] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.829] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.829] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0260.829] lstrlenW (lpString="desktop.ini") returned 11 [0260.829] lstrlenW (lpString=".1cd") returned 4 [0260.829] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0260.829] lstrlenW (lpString=".3ds") returned 4 [0260.829] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0260.829] lstrlenW (lpString=".3fr") returned 4 [0260.829] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0260.829] lstrlenW (lpString=".3g2") returned 4 [0260.829] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0260.829] lstrlenW (lpString=".3gp") returned 4 [0260.829] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0260.829] lstrlenW (lpString=".7z") returned 3 [0260.829] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0260.830] lstrlenW (lpString=".accda") returned 6 [0260.830] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0260.830] lstrlenW (lpString=".accdb") returned 6 [0260.830] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0260.830] lstrlenW (lpString=".accdc") returned 6 [0260.830] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0260.830] lstrlenW (lpString=".accde") returned 6 [0260.830] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0260.830] lstrlenW (lpString=".accdt") returned 6 [0260.830] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0260.830] lstrlenW (lpString=".accdw") returned 6 [0260.830] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0260.830] lstrlenW (lpString=".adb") returned 4 [0260.830] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".adp") returned 4 [0260.830] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".ai") returned 3 [0260.830] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0260.830] lstrlenW (lpString=".ai3") returned 4 [0260.830] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".ai4") returned 4 [0260.830] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".ai5") returned 4 [0260.830] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".ai6") returned 4 [0260.830] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".ai7") returned 4 [0260.830] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".ai8") returned 4 [0260.830] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0260.830] lstrlenW (lpString=".anim") returned 5 [0260.831] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0260.831] lstrlenW (lpString=".arw") returned 4 [0260.831] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".as") returned 3 [0260.831] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0260.831] lstrlenW (lpString=".asa") returned 4 [0260.831] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".asc") returned 4 [0260.831] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".ascx") returned 5 [0260.831] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0260.831] lstrlenW (lpString=".asm") returned 4 [0260.831] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".asmx") returned 5 [0260.831] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0260.831] lstrlenW (lpString=".asp") returned 4 [0260.831] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".aspx") returned 5 [0260.831] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0260.831] lstrlenW (lpString=".asr") returned 4 [0260.831] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".asx") returned 4 [0260.831] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".avi") returned 4 [0260.831] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".avs") returned 4 [0260.831] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0260.831] lstrlenW (lpString=".backup") returned 7 [0260.831] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0260.831] lstrlenW (lpString=".bak") returned 4 [0260.832] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".bay") returned 4 [0260.832] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".bd") returned 3 [0260.832] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0260.832] lstrlenW (lpString=".bin") returned 4 [0260.832] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".bmp") returned 4 [0260.832] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".bz2") returned 4 [0260.832] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".c") returned 2 [0260.832] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0260.832] lstrlenW (lpString=".cdr") returned 4 [0260.832] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".cer") returned 4 [0260.832] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".cf") returned 3 [0260.832] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0260.832] lstrlenW (lpString=".cfc") returned 4 [0260.832] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".cfm") returned 4 [0260.832] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".cfml") returned 5 [0260.832] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0260.832] lstrlenW (lpString=".cfu") returned 4 [0260.832] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".chm") returned 4 [0260.832] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0260.832] lstrlenW (lpString=".cin") returned 4 [0260.833] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".class") returned 6 [0260.833] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0260.833] lstrlenW (lpString=".clx") returned 4 [0260.833] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".config") returned 7 [0260.833] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0260.833] lstrlenW (lpString=".cpp") returned 4 [0260.833] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".cr2") returned 4 [0260.833] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".crt") returned 4 [0260.833] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".crw") returned 4 [0260.833] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".cs") returned 3 [0260.833] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0260.833] lstrlenW (lpString=".css") returned 4 [0260.833] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".csv") returned 4 [0260.833] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".cub") returned 4 [0260.833] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".dae") returned 4 [0260.833] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".dat") returned 4 [0260.833] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".db") returned 3 [0260.833] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0260.833] lstrlenW (lpString=".dbf") returned 4 [0260.833] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0260.833] lstrlenW (lpString=".dbx") returned 4 [0260.833] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dc3") returned 4 [0260.834] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dcm") returned 4 [0260.834] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dcr") returned 4 [0260.834] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".der") returned 4 [0260.834] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dib") returned 4 [0260.834] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dic") returned 4 [0260.834] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dif") returned 4 [0260.834] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".divx") returned 5 [0260.834] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0260.834] lstrlenW (lpString=".djvu") returned 5 [0260.834] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0260.834] lstrlenW (lpString=".dng") returned 4 [0260.834] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".doc") returned 4 [0260.834] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".docm") returned 5 [0260.834] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0260.834] lstrlenW (lpString=".docx") returned 5 [0260.834] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0260.834] lstrlenW (lpString=".dot") returned 4 [0260.834] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dotm") returned 5 [0260.834] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0260.834] lstrlenW (lpString=".dotx") returned 5 [0260.834] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0260.834] lstrlenW (lpString=".dpx") returned 4 [0260.834] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dqy") returned 4 [0260.834] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0260.834] lstrlenW (lpString=".dsn") returned 4 [0260.835] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".dt") returned 3 [0260.835] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0260.835] lstrlenW (lpString=".dtd") returned 4 [0260.835] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".dwg") returned 4 [0260.835] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".dwt") returned 4 [0260.835] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".dx") returned 3 [0260.835] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0260.835] lstrlenW (lpString=".dxf") returned 4 [0260.835] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".edml") returned 5 [0260.835] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0260.835] lstrlenW (lpString=".efd") returned 4 [0260.835] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".elf") returned 4 [0260.835] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".emf") returned 4 [0260.835] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0260.835] lstrlenW (lpString=".emz") returned 4 [0260.835] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".epf") returned 4 [0260.836] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".eps") returned 4 [0260.836] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".epsf") returned 5 [0260.836] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0260.836] lstrlenW (lpString=".epsp") returned 5 [0260.836] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0260.836] lstrlenW (lpString=".erf") returned 4 [0260.836] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".exr") returned 4 [0260.836] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".f4v") returned 4 [0260.836] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".fido") returned 5 [0260.836] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0260.836] lstrlenW (lpString=".flm") returned 4 [0260.836] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0260.836] lstrlenW (lpString=".flv") returned 4 [0260.836] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".frm") returned 4 [0260.837] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".fxg") returned 4 [0260.837] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".geo") returned 4 [0260.837] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".gif") returned 4 [0260.837] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".grs") returned 4 [0260.837] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".gz") returned 3 [0260.837] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0260.837] lstrlenW (lpString=".h") returned 2 [0260.837] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0260.837] lstrlenW (lpString=".hdr") returned 4 [0260.837] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".hpp") returned 4 [0260.837] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".hta") returned 4 [0260.837] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".htc") returned 4 [0260.837] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".htm") returned 4 [0260.837] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".html") returned 5 [0260.837] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0260.837] lstrlenW (lpString=".icb") returned 4 [0260.837] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0260.837] lstrlenW (lpString=".ics") returned 4 [0260.837] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0260.838] lstrlenW (lpString=".iff") returned 4 [0260.838] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0260.838] lstrlenW (lpString=".inc") returned 4 [0260.838] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0260.838] lstrlenW (lpString=".indd") returned 5 [0260.838] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0260.838] lstrlenW (lpString=".ini") returned 4 [0260.838] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0260.838] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0260.838] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.838] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.838] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0260.839] FindClose (in: hFindFile=0x3310c8 | out: hFindFile=0x3310c8) returned 1 [0260.839] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39506e0 | out: hHeap=0x2e0000) returned 1 [0260.839] FindNextFileW (in: hFindFile=0x331088, lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0260.839] lstrlenW (lpString="C:\\Boot") returned 7 [0260.839] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0260.839] lstrlenW (lpString="Boot") returned 4 [0260.839] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0260.839] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39506e0 [0260.839] lstrlenW (lpString="C:\\Boot") returned 7 [0260.839] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3310c8 [0260.839] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.839] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0260.840] lstrlenW (lpString="BCD") returned 3 [0260.840] lstrlenW (lpString=".1cd") returned 4 [0260.840] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".3ds") returned 4 [0260.840] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".3fr") returned 4 [0260.840] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".3g2") returned 4 [0260.840] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".3gp") returned 4 [0260.840] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".7z") returned 3 [0260.840] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0260.840] lstrlenW (lpString=".accda") returned 6 [0260.840] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".accdb") returned 6 [0260.840] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".accdc") returned 6 [0260.840] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".accde") returned 6 [0260.840] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".accdt") returned 6 [0260.840] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".accdw") returned 6 [0260.840] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0260.840] lstrlenW (lpString=".adb") returned 4 [0260.840] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".adp") returned 4 [0260.841] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ai") returned 3 [0260.841] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0260.841] lstrlenW (lpString=".ai3") returned 4 [0260.841] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ai4") returned 4 [0260.841] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ai5") returned 4 [0260.841] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ai6") returned 4 [0260.841] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ai7") returned 4 [0260.841] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ai8") returned 4 [0260.841] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".anim") returned 5 [0260.841] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".arw") returned 4 [0260.841] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".as") returned 3 [0260.841] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0260.841] lstrlenW (lpString=".asa") returned 4 [0260.841] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".asc") returned 4 [0260.841] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0260.841] lstrlenW (lpString=".ascx") returned 5 [0260.842] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".asm") returned 4 [0260.842] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".asmx") returned 5 [0260.842] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".asp") returned 4 [0260.842] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".aspx") returned 5 [0260.842] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".asr") returned 4 [0260.842] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".asx") returned 4 [0260.842] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".avi") returned 4 [0260.842] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".avs") returned 4 [0260.842] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".backup") returned 7 [0260.842] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".bak") returned 4 [0260.842] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".bay") returned 4 [0260.842] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".bd") returned 3 [0260.842] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0260.842] lstrlenW (lpString=".bin") returned 4 [0260.842] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0260.842] lstrlenW (lpString=".bmp") returned 4 [0260.842] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".bz2") returned 4 [0260.843] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".c") returned 2 [0260.843] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0260.843] lstrlenW (lpString=".cdr") returned 4 [0260.843] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".cer") returned 4 [0260.843] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".cf") returned 3 [0260.843] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0260.843] lstrlenW (lpString=".cfc") returned 4 [0260.843] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".cfm") returned 4 [0260.843] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".cfml") returned 5 [0260.843] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".cfu") returned 4 [0260.843] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".chm") returned 4 [0260.843] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".cin") returned 4 [0260.843] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".class") returned 6 [0260.843] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".clx") returned 4 [0260.843] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0260.843] lstrlenW (lpString=".config") returned 7 [0260.843] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".cpp") returned 4 [0260.844] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".cr2") returned 4 [0260.844] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".crt") returned 4 [0260.844] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".crw") returned 4 [0260.844] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".cs") returned 3 [0260.844] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0260.844] lstrlenW (lpString=".css") returned 4 [0260.844] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".csv") returned 4 [0260.844] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".cub") returned 4 [0260.844] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".dae") returned 4 [0260.844] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".dat") returned 4 [0260.844] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".db") returned 3 [0260.844] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0260.844] lstrlenW (lpString=".dbf") returned 4 [0260.844] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".dbx") returned 4 [0260.844] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".dc3") returned 4 [0260.844] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0260.844] lstrlenW (lpString=".dcm") returned 4 [0260.844] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dcr") returned 4 [0260.845] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".der") returned 4 [0260.845] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dib") returned 4 [0260.845] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dic") returned 4 [0260.845] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dif") returned 4 [0260.845] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".divx") returned 5 [0260.845] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".djvu") returned 5 [0260.845] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dng") returned 4 [0260.845] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".doc") returned 4 [0260.845] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".docm") returned 5 [0260.845] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".docx") returned 5 [0260.845] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dot") returned 4 [0260.845] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dotm") returned 5 [0260.845] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dotx") returned 5 [0260.845] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0260.845] lstrlenW (lpString=".dpx") returned 4 [0260.845] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".dqy") returned 4 [0260.846] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".dsn") returned 4 [0260.846] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".dt") returned 3 [0260.846] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0260.846] lstrlenW (lpString=".dtd") returned 4 [0260.846] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".dwg") returned 4 [0260.846] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".dwt") returned 4 [0260.846] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".dx") returned 3 [0260.846] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0260.846] lstrlenW (lpString=".dxf") returned 4 [0260.846] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".edml") returned 5 [0260.846] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".efd") returned 4 [0260.846] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".elf") returned 4 [0260.846] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".emf") returned 4 [0260.846] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".emz") returned 4 [0260.846] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".epf") returned 4 [0260.846] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0260.846] lstrlenW (lpString=".eps") returned 4 [0260.847] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".epsf") returned 5 [0260.847] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".epsp") returned 5 [0260.847] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".erf") returned 4 [0260.847] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".exr") returned 4 [0260.847] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".f4v") returned 4 [0260.847] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".fido") returned 5 [0260.847] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".flm") returned 4 [0260.847] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".flv") returned 4 [0260.847] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".frm") returned 4 [0260.847] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0260.847] lstrlenW (lpString=".fxg") returned 4 [0260.847] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0260.847] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.848] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.848] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.848] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.849] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.849] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.849] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0260.849] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.849] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.850] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.850] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.850] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.850] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.850] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0260.850] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.850] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.851] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.851] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.851] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.851] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.851] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0260.851] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.851] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.852] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.852] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.852] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.852] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.852] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0260.852] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.852] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.853] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.853] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.853] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.853] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.853] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0260.853] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.853] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.854] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.854] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.854] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.854] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.854] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0260.854] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.854] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.855] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.855] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.855] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.855] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.855] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0260.855] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.855] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.856] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.856] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0260.856] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.856] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.856] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0260.856] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.856] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.857] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.857] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.857] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.857] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.857] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0260.858] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.858] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.858] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.858] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.858] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.858] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.858] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0260.858] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.858] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.859] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.859] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.859] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.859] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.859] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0260.859] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.859] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.860] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.860] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.860] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.860] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.860] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0260.860] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.860] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.861] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.861] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.861] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.862] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.862] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0260.862] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.862] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.862] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.862] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.862] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.862] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.862] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0260.862] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.862] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.863] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.863] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.863] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.863] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.863] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0260.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.864] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.864] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.864] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.864] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.864] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.864] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0260.864] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.864] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.865] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.865] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.865] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.865] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.865] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0260.865] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.865] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.866] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.866] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.866] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.866] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.866] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0260.866] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.866] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.870] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.870] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.871] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.871] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.871] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0260.871] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.871] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0260.871] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.871] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0260.871] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0260.871] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0260.871] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0260.871] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0260.872] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0261.295] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.295] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0261.296] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0261.296] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0261.296] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0261.296] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0261.296] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0261.296] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.296] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0261.297] FindClose (in: hFindFile=0x331108 | out: hFindFile=0x331108) returned 1 [0261.297] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0261.297] FindNextFileW (in: hFindFile=0x3310c8, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0261.297] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0261.297] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x331108 [0261.335] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.335] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0261.572] FindNextFileW (in: hFindFile=0x331148, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.572] FindNextFileW (in: hFindFile=0x331148, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0261.572] FindNextFileW (in: hFindFile=0x331148, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0261.572] FindNextFileW (in: hFindFile=0x331148, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0261.573] FindClose (in: hFindFile=0x331148 | out: hFindFile=0x331148) returned 1 [0261.573] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3ed0048 | out: hHeap=0x2e0000) returned 1 [0261.573] FindNextFileW (in: hFindFile=0x331108, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0261.573] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3ed0048 [0261.588] FindNextFileW (in: hFindFile=0x331188, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.589] FindNextFileW (in: hFindFile=0x331188, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0262.601] FindNextFileW (in: hFindFile=0x3f02888, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.602] FindNextFileW (in: hFindFile=0x3f02888, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0262.602] lstrlenW (lpString="Office32WW.msi") returned 14 [0262.602] lstrlenW (lpString=".1cd") returned 4 [0262.602] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".3ds") returned 4 [0262.602] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".3fr") returned 4 [0262.602] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".3g2") returned 4 [0262.602] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".3gp") returned 4 [0262.602] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".7z") returned 3 [0262.602] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0262.602] lstrlenW (lpString=".accda") returned 6 [0262.602] lstrcmpiW (lpString1=".accda", lpString2="WW.msi") returned -1 [0262.602] lstrlenW (lpString=".accdb") returned 6 [0262.602] lstrcmpiW (lpString1=".accdb", lpString2="WW.msi") returned -1 [0262.602] lstrlenW (lpString=".accdc") returned 6 [0262.602] lstrcmpiW (lpString1=".accdc", lpString2="WW.msi") returned -1 [0262.602] lstrlenW (lpString=".accde") returned 6 [0262.602] lstrcmpiW (lpString1=".accde", lpString2="WW.msi") returned -1 [0262.602] lstrlenW (lpString=".accdt") returned 6 [0262.602] lstrcmpiW (lpString1=".accdt", lpString2="WW.msi") returned -1 [0262.602] lstrlenW (lpString=".accdw") returned 6 [0262.602] lstrcmpiW (lpString1=".accdw", lpString2="WW.msi") returned -1 [0262.602] lstrlenW (lpString=".adb") returned 4 [0262.602] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".adp") returned 4 [0262.602] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1 [0262.602] lstrlenW (lpString=".ai") returned 3 [0262.602] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1 [0262.602] lstrlenW (lpString=".ai3") returned 4 [0262.602] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".ai4") returned 4 [0262.603] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".ai5") returned 4 [0262.603] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".ai6") returned 4 [0262.603] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".ai7") returned 4 [0262.603] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".ai8") returned 4 [0262.603] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".anim") returned 5 [0262.603] lstrcmpiW (lpString1=".anim", lpString2="W.msi") returned -1 [0262.603] lstrlenW (lpString=".arw") returned 4 [0262.603] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".as") returned 3 [0262.603] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1 [0262.603] lstrlenW (lpString=".asa") returned 4 [0262.603] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".asc") returned 4 [0262.603] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".ascx") returned 5 [0262.603] lstrcmpiW (lpString1=".ascx", lpString2="W.msi") returned -1 [0262.603] lstrlenW (lpString=".asm") returned 4 [0262.603] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".asmx") returned 5 [0262.603] lstrcmpiW (lpString1=".asmx", lpString2="W.msi") returned -1 [0262.603] lstrlenW (lpString=".asp") returned 4 [0262.603] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".aspx") returned 5 [0262.603] lstrcmpiW (lpString1=".aspx", lpString2="W.msi") returned -1 [0262.603] lstrlenW (lpString=".asr") returned 4 [0262.603] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".asx") returned 4 [0262.603] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1 [0262.603] lstrlenW (lpString=".avi") returned 4 [0262.604] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".avs") returned 4 [0262.604] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".backup") returned 7 [0262.604] lstrcmpiW (lpString1=".backup", lpString2="2WW.msi") returned -1 [0262.604] lstrlenW (lpString=".bak") returned 4 [0262.604] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".bay") returned 4 [0262.604] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".bd") returned 3 [0262.604] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1 [0262.604] lstrlenW (lpString=".bin") returned 4 [0262.604] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".bmp") returned 4 [0262.604] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".bz2") returned 4 [0262.604] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".c") returned 2 [0262.604] lstrcmpiW (lpString1=".c", lpString2="si") returned -1 [0262.604] lstrlenW (lpString=".cdr") returned 4 [0262.604] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".cer") returned 4 [0262.604] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1 [0262.604] lstrlenW (lpString=".cf") returned 3 [0262.604] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1 [0262.604] lstrlenW (lpString=".cfc") returned 4 [0262.605] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".cfm") returned 4 [0262.605] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".cfml") returned 5 [0262.605] lstrcmpiW (lpString1=".cfml", lpString2="W.msi") returned -1 [0262.605] lstrlenW (lpString=".cfu") returned 4 [0262.605] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".chm") returned 4 [0262.605] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".cin") returned 4 [0262.605] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".class") returned 6 [0262.605] lstrcmpiW (lpString1=".class", lpString2="WW.msi") returned -1 [0262.605] lstrlenW (lpString=".clx") returned 4 [0262.605] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".config") returned 7 [0262.605] lstrcmpiW (lpString1=".config", lpString2="2WW.msi") returned -1 [0262.605] lstrlenW (lpString=".cpp") returned 4 [0262.605] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".cr2") returned 4 [0262.605] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".crt") returned 4 [0262.605] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".crw") returned 4 [0262.605] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".cs") returned 3 [0262.605] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1 [0262.605] lstrlenW (lpString=".css") returned 4 [0262.605] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".csv") returned 4 [0262.605] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".cub") returned 4 [0262.605] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1 [0262.605] lstrlenW (lpString=".dae") returned 4 [0262.605] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dat") returned 4 [0262.606] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".db") returned 3 [0262.606] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1 [0262.606] lstrlenW (lpString=".dbf") returned 4 [0262.606] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dbx") returned 4 [0262.606] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dc3") returned 4 [0262.606] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dcm") returned 4 [0262.606] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dcr") returned 4 [0262.606] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".der") returned 4 [0262.606] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dib") returned 4 [0262.606] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dic") returned 4 [0262.606] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".dif") returned 4 [0262.606] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".divx") returned 5 [0262.606] lstrcmpiW (lpString1=".divx", lpString2="W.msi") returned -1 [0262.606] lstrlenW (lpString=".djvu") returned 5 [0262.606] lstrcmpiW (lpString1=".djvu", lpString2="W.msi") returned -1 [0262.606] lstrlenW (lpString=".dng") returned 4 [0262.606] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".doc") returned 4 [0262.606] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0262.606] lstrlenW (lpString=".docm") returned 5 [0262.606] lstrcmpiW (lpString1=".docm", lpString2="W.msi") returned -1 [0262.606] lstrlenW (lpString=".docx") returned 5 [0262.606] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0262.607] lstrlenW (lpString=".dot") returned 4 [0262.607] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dotm") returned 5 [0262.607] lstrcmpiW (lpString1=".dotm", lpString2="W.msi") returned -1 [0262.607] lstrlenW (lpString=".dotx") returned 5 [0262.607] lstrcmpiW (lpString1=".dotx", lpString2="W.msi") returned -1 [0262.607] lstrlenW (lpString=".dpx") returned 4 [0262.607] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dqy") returned 4 [0262.607] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dsn") returned 4 [0262.607] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dt") returned 3 [0262.607] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1 [0262.607] lstrlenW (lpString=".dtd") returned 4 [0262.607] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dwg") returned 4 [0262.607] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dwt") returned 4 [0262.607] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".dx") returned 3 [0262.607] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1 [0262.607] lstrlenW (lpString=".dxf") returned 4 [0262.607] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".edml") returned 5 [0262.607] lstrcmpiW (lpString1=".edml", lpString2="W.msi") returned -1 [0262.607] lstrlenW (lpString=".efd") returned 4 [0262.607] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".elf") returned 4 [0262.607] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".emf") returned 4 [0262.607] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0262.607] lstrlenW (lpString=".emz") returned 4 [0262.607] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".epf") returned 4 [0262.608] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".eps") returned 4 [0262.608] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".epsf") returned 5 [0262.608] lstrcmpiW (lpString1=".epsf", lpString2="W.msi") returned -1 [0262.608] lstrlenW (lpString=".epsp") returned 5 [0262.608] lstrcmpiW (lpString1=".epsp", lpString2="W.msi") returned -1 [0262.608] lstrlenW (lpString=".erf") returned 4 [0262.608] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".exr") returned 4 [0262.608] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".f4v") returned 4 [0262.608] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".fido") returned 5 [0262.608] lstrcmpiW (lpString1=".fido", lpString2="W.msi") returned -1 [0262.608] lstrlenW (lpString=".flm") returned 4 [0262.608] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".flv") returned 4 [0262.608] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".frm") returned 4 [0262.608] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".fxg") returned 4 [0262.608] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".geo") returned 4 [0262.608] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".gif") returned 4 [0262.608] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".grs") returned 4 [0262.608] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".gz") returned 3 [0262.608] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1 [0262.608] lstrlenW (lpString=".h") returned 2 [0262.608] lstrcmpiW (lpString1=".h", lpString2="si") returned -1 [0262.608] lstrlenW (lpString=".hdr") returned 4 [0262.608] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1 [0262.608] lstrlenW (lpString=".hpp") returned 4 [0262.609] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".hta") returned 4 [0262.609] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".htc") returned 4 [0262.609] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".htm") returned 4 [0262.609] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".html") returned 5 [0262.609] lstrcmpiW (lpString1=".html", lpString2="W.msi") returned -1 [0262.609] lstrlenW (lpString=".icb") returned 4 [0262.609] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".ics") returned 4 [0262.609] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".iff") returned 4 [0262.609] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".inc") returned 4 [0262.609] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".indd") returned 5 [0262.609] lstrcmpiW (lpString1=".indd", lpString2="W.msi") returned -1 [0262.609] lstrlenW (lpString=".ini") returned 4 [0262.609] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".iqy") returned 4 [0262.609] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".j2c") returned 4 [0262.609] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".j2k") returned 4 [0262.609] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".java") returned 5 [0262.609] lstrcmpiW (lpString1=".java", lpString2="W.msi") returned -1 [0262.609] lstrlenW (lpString=".jp2") returned 4 [0262.609] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".jpc") returned 4 [0262.609] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1 [0262.609] lstrlenW (lpString=".jpe") returned 4 [0262.610] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".jpeg") returned 5 [0262.610] lstrcmpiW (lpString1=".jpeg", lpString2="W.msi") returned -1 [0262.610] lstrlenW (lpString=".jpf") returned 4 [0262.610] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".jpg") returned 4 [0262.610] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".jpx") returned 4 [0262.610] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".js") returned 3 [0262.610] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1 [0262.610] lstrlenW (lpString=".jsf") returned 4 [0262.610] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".json") returned 5 [0262.610] lstrcmpiW (lpString1=".json", lpString2="W.msi") returned -1 [0262.610] lstrlenW (lpString=".jsp") returned 4 [0262.610] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".kdc") returned 4 [0262.610] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".kmz") returned 4 [0262.610] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".kwm") returned 4 [0262.610] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".lasso") returned 6 [0262.610] lstrcmpiW (lpString1=".lasso", lpString2="WW.msi") returned -1 [0262.610] lstrlenW (lpString=".lbi") returned 4 [0262.610] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".lgf") returned 4 [0262.610] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".lgp") returned 4 [0262.610] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1 [0262.610] lstrlenW (lpString=".log") returned 4 [0262.611] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".m1v") returned 4 [0262.611] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".m4a") returned 4 [0262.611] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".m4v") returned 4 [0262.611] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".max") returned 4 [0262.611] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".md") returned 3 [0262.611] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1 [0262.611] lstrlenW (lpString=".mda") returned 4 [0262.611] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mdb") returned 4 [0262.611] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mde") returned 4 [0262.611] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mdf") returned 4 [0262.611] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mdw") returned 4 [0262.611] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mef") returned 4 [0262.611] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mft") returned 4 [0262.611] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mfw") returned 4 [0262.611] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mht") returned 4 [0262.611] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mhtml") returned 6 [0262.611] lstrcmpiW (lpString1=".mhtml", lpString2="WW.msi") returned -1 [0262.611] lstrlenW (lpString=".mka") returned 4 [0262.611] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1 [0262.611] lstrlenW (lpString=".mkidx") returned 6 [0262.611] lstrcmpiW (lpString1=".mkidx", lpString2="WW.msi") returned -1 [0262.611] lstrlenW (lpString=".mkv") returned 4 [0262.611] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mos") returned 4 [0262.612] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mov") returned 4 [0262.612] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mp3") returned 4 [0262.612] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mp4") returned 4 [0262.612] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mpeg") returned 5 [0262.612] lstrcmpiW (lpString1=".mpeg", lpString2="W.msi") returned -1 [0262.612] lstrlenW (lpString=".mpg") returned 4 [0262.612] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mpv") returned 4 [0262.612] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mrw") returned 4 [0262.612] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".msg") returned 4 [0262.612] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1 [0262.612] lstrlenW (lpString=".mxl") returned 4 [0262.612] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".myd") returned 4 [0262.612] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".myi") returned 4 [0262.612] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".nef") returned 4 [0262.612] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".nrw") returned 4 [0262.612] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".obj") returned 4 [0262.612] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".odb") returned 4 [0262.612] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".odc") returned 4 [0262.612] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".odm") returned 4 [0262.612] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1 [0262.612] lstrlenW (lpString=".odp") returned 4 [0262.613] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".ods") returned 4 [0262.613] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".oft") returned 4 [0262.613] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".one") returned 4 [0262.613] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".onepkg") returned 7 [0262.613] lstrcmpiW (lpString1=".onepkg", lpString2="2WW.msi") returned -1 [0262.613] lstrlenW (lpString=".onetoc2") returned 8 [0262.613] lstrcmpiW (lpString1=".onetoc2", lpString2="32WW.msi") returned -1 [0262.613] lstrlenW (lpString=".opt") returned 4 [0262.613] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".oqy") returned 4 [0262.613] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".orf") returned 4 [0262.613] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".p12") returned 4 [0262.613] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".p7b") returned 4 [0262.613] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".p7c") returned 4 [0262.613] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".pam") returned 4 [0262.613] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".pbm") returned 4 [0262.613] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".pct") returned 4 [0262.613] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".pcx") returned 4 [0262.613] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".pdd") returned 4 [0262.613] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1 [0262.613] lstrlenW (lpString=".pdf") returned 4 [0262.613] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pdp") returned 4 [0262.614] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pef") returned 4 [0262.614] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pem") returned 4 [0262.614] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pff") returned 4 [0262.614] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pfm") returned 4 [0262.614] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pfx") returned 4 [0262.614] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".pgm") returned 4 [0262.614] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".php") returned 4 [0262.614] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1 [0262.614] lstrlenW (lpString=".php3") returned 5 [0262.614] lstrcmpiW (lpString1=".php3", lpString2="W.msi") returned -1 [0262.614] lstrlenW (lpString=".php4") returned 5 [0262.614] lstrcmpiW (lpString1=".php4", lpString2="W.msi") returned -1 [0262.614] lstrlenW (lpString=".php5") returned 5 [0262.614] lstrcmpiW (lpString1=".php5", lpString2="W.msi") returned -1 [0262.614] lstrlenW (lpString=".phtml") returned 6 [0262.614] lstrcmpiW (lpString1=".phtml", lpString2="WW.msi") returned -1 [0262.614] lstrlenW (lpString=".pict") returned 5 [0262.614] lstrcmpiW (lpString1=".pict", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".pl") returned 3 [0262.615] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1 [0262.615] lstrlenW (lpString=".pls") returned 4 [0262.615] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".pm") returned 3 [0262.615] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1 [0262.615] lstrlenW (lpString=".png") returned 4 [0262.615] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".pnm") returned 4 [0262.615] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".pot") returned 4 [0262.615] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".potm") returned 5 [0262.615] lstrcmpiW (lpString1=".potm", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".potx") returned 5 [0262.615] lstrcmpiW (lpString1=".potx", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".ppa") returned 4 [0262.615] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".ppam") returned 5 [0262.615] lstrcmpiW (lpString1=".ppam", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".ppm") returned 4 [0262.615] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".pps") returned 4 [0262.615] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".ppsm") returned 5 [0262.615] lstrcmpiW (lpString1=".ppsm", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".ppt") returned 4 [0262.615] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".pptm") returned 5 [0262.615] lstrcmpiW (lpString1=".pptm", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".pptx") returned 5 [0262.615] lstrcmpiW (lpString1=".pptx", lpString2="W.msi") returned -1 [0262.615] lstrlenW (lpString=".prn") returned 4 [0262.615] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1 [0262.615] lstrlenW (lpString=".ps") returned 3 [0262.616] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1 [0262.616] lstrlenW (lpString=".psb") returned 4 [0262.616] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".psd") returned 4 [0262.616] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".pst") returned 4 [0262.616] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".ptx") returned 4 [0262.616] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".pub") returned 4 [0262.616] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".pwm") returned 4 [0262.616] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".pxr") returned 4 [0262.616] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".py") returned 3 [0262.616] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1 [0262.616] lstrlenW (lpString=".qt") returned 3 [0262.616] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1 [0262.616] lstrlenW (lpString=".r3d") returned 4 [0262.616] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".raf") returned 4 [0262.616] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".rar") returned 4 [0262.616] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0262.616] lstrlenW (lpString=".raw") returned 4 [0262.616] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1 [0262.616] FindNextFileW (in: hFindFile=0x3f02888, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0262.617] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3391f8, Size=0x4000) returned 0x39756f8 [0262.617] FindNextFileW (in: hFindFile=0x3f02888, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.739] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0263.740] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0263.740] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0263.740] FindNextFileW (in: hFindFile=0x3f02908, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0263.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0263.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.393] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.393] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0264.393] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0264.393] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0264.395] FindNextFileW (in: hFindFile=0x3f02908, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0264.395] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x39606e8 [0264.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe9d27690, ftLastAccessTime.dwHighDateTime=0x1d5097a, ftLastWriteTime.dwLowDateTime=0xe9d73950, ftLastWriteTime.dwHighDateTime=0x1d5097a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0264.396] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe9d27690, ftLastAccessTime.dwHighDateTime=0x1d5097a, ftLastWriteTime.dwLowDateTime=0xe9d73950, ftLastWriteTime.dwHighDateTime=0x1d5097a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.396] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0265.417] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.417] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0265.418] FindClose (in: hFindFile=0x3f02b48 | out: hFindFile=0x3f02b48) returned 1 [0265.418] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f13878 | out: hHeap=0x2e0000) returned 1 [0265.421] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0265.421] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f13878 [0265.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02b48 [0265.444] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.444] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0265.444] FindClose (in: hFindFile=0x3f02b48 | out: hFindFile=0x3f02b48) returned 1 [0265.444] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f13878 | out: hHeap=0x2e0000) returned 1 [0265.444] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0265.444] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f13878 [0265.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02b48 [0265.516] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.516] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0265.516] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x3f34890, Size=0x10000) returned 0x3f5c8a8 [0265.517] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0265.518] FindClose (in: hFindFile=0x3f02b48 | out: hFindFile=0x3f02b48) returned 1 [0265.518] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f13878 | out: hHeap=0x2e0000) returned 1 [0265.518] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0265.518] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f13878 [0265.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02b48 [0265.521] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.521] FindNextFileW (in: hFindFile=0x3f02b48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0267.215] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.215] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0267.215] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0267.215] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.215] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.216] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.216] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0267.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 62 [0267.216] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 1 [0267.216] lstrlenW (lpString="LAYERS") returned 6 [0267.216] lstrcmpiW (lpString1="C:\\Windows", lpString2="LAYERS") returned -1 [0267.216] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0xfffe) returned 0x3f43878 [0267.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 62 [0267.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.719] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.719] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0267.719] lstrlenW (lpString="LAYERS.ELM") returned 10 [0267.719] lstrlenW (lpString=".1cd") returned 4 [0267.719] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0267.719] lstrlenW (lpString=".3ds") returned 4 [0267.719] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1 [0267.719] lstrlenW (lpString=".3fr") returned 4 [0267.719] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1 [0267.719] lstrlenW (lpString=".3g2") returned 4 [0267.719] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1 [0267.719] lstrlenW (lpString=".3gp") returned 4 [0267.719] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1 [0267.719] lstrlenW (lpString=".7z") returned 3 [0267.719] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0267.719] lstrlenW (lpString=".accda") returned 6 [0267.719] lstrcmpiW (lpString1=".accda", lpString2="RS.ELM") returned -1 [0267.719] lstrlenW (lpString=".accdb") returned 6 [0267.719] lstrcmpiW (lpString1=".accdb", lpString2="RS.ELM") returned -1 [0267.719] lstrlenW (lpString=".accdc") returned 6 [0267.719] lstrcmpiW (lpString1=".accdc", lpString2="RS.ELM") returned -1 [0267.719] lstrlenW (lpString=".accde") returned 6 [0267.720] lstrcmpiW (lpString1=".accde", lpString2="RS.ELM") returned -1 [0267.720] lstrlenW (lpString=".accdt") returned 6 [0267.720] lstrcmpiW (lpString1=".accdt", lpString2="RS.ELM") returned -1 [0267.720] lstrlenW (lpString=".accdw") returned 6 [0267.720] lstrcmpiW (lpString1=".accdw", lpString2="RS.ELM") returned -1 [0267.720] lstrlenW (lpString=".adb") returned 4 [0267.720] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".adp") returned 4 [0267.720] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ai") returned 3 [0267.720] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1 [0267.720] lstrlenW (lpString=".ai3") returned 4 [0267.720] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ai4") returned 4 [0267.720] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ai5") returned 4 [0267.720] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ai6") returned 4 [0267.720] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ai7") returned 4 [0267.720] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ai8") returned 4 [0267.720] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".anim") returned 5 [0267.720] lstrcmpiW (lpString1=".anim", lpString2="S.ELM") returned -1 [0267.720] lstrlenW (lpString=".arw") returned 4 [0267.720] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".as") returned 3 [0267.720] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1 [0267.720] lstrlenW (lpString=".asa") returned 4 [0267.720] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".asc") returned 4 [0267.720] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".ascx") returned 5 [0267.720] lstrcmpiW (lpString1=".ascx", lpString2="S.ELM") returned -1 [0267.720] lstrlenW (lpString=".asm") returned 4 [0267.720] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1 [0267.720] lstrlenW (lpString=".asmx") returned 5 [0267.721] lstrcmpiW (lpString1=".asmx", lpString2="S.ELM") returned -1 [0267.721] lstrlenW (lpString=".asp") returned 4 [0267.721] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".aspx") returned 5 [0267.721] lstrcmpiW (lpString1=".aspx", lpString2="S.ELM") returned -1 [0267.721] lstrlenW (lpString=".asr") returned 4 [0267.721] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".asx") returned 4 [0267.721] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".avi") returned 4 [0267.721] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".avs") returned 4 [0267.721] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".backup") returned 7 [0267.721] lstrcmpiW (lpString1=".backup", lpString2="ERS.ELM") returned -1 [0267.721] lstrlenW (lpString=".bak") returned 4 [0267.721] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".bay") returned 4 [0267.721] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".bd") returned 3 [0267.721] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1 [0267.721] lstrlenW (lpString=".bin") returned 4 [0267.721] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".bmp") returned 4 [0267.721] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".bz2") returned 4 [0267.721] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".c") returned 2 [0267.721] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1 [0267.721] lstrlenW (lpString=".cdr") returned 4 [0267.721] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".cer") returned 4 [0267.721] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".cf") returned 3 [0267.721] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1 [0267.721] lstrlenW (lpString=".cfc") returned 4 [0267.721] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1 [0267.721] lstrlenW (lpString=".cfm") returned 4 [0267.722] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".cfml") returned 5 [0267.722] lstrcmpiW (lpString1=".cfml", lpString2="S.ELM") returned -1 [0267.722] lstrlenW (lpString=".cfu") returned 4 [0267.722] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".chm") returned 4 [0267.722] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".cin") returned 4 [0267.722] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".class") returned 6 [0267.722] lstrcmpiW (lpString1=".class", lpString2="RS.ELM") returned -1 [0267.722] lstrlenW (lpString=".clx") returned 4 [0267.722] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".config") returned 7 [0267.722] lstrcmpiW (lpString1=".config", lpString2="ERS.ELM") returned -1 [0267.722] lstrlenW (lpString=".cpp") returned 4 [0267.722] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".cr2") returned 4 [0267.722] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".crt") returned 4 [0267.722] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".crw") returned 4 [0267.722] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".cs") returned 3 [0267.722] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1 [0267.722] lstrlenW (lpString=".css") returned 4 [0267.722] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".csv") returned 4 [0267.722] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".cub") returned 4 [0267.722] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".dae") returned 4 [0267.722] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".dat") returned 4 [0267.722] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1 [0267.722] lstrlenW (lpString=".db") returned 3 [0267.722] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1 [0267.723] lstrlenW (lpString=".dbf") returned 4 [0267.723] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dbx") returned 4 [0267.723] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dc3") returned 4 [0267.723] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dcm") returned 4 [0267.723] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dcr") returned 4 [0267.723] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".der") returned 4 [0267.723] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dib") returned 4 [0267.723] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dic") returned 4 [0267.723] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dif") returned 4 [0267.723] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".divx") returned 5 [0267.723] lstrcmpiW (lpString1=".divx", lpString2="S.ELM") returned -1 [0267.723] lstrlenW (lpString=".djvu") returned 5 [0267.723] lstrcmpiW (lpString1=".djvu", lpString2="S.ELM") returned -1 [0267.723] lstrlenW (lpString=".dng") returned 4 [0267.723] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".doc") returned 4 [0267.723] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".docm") returned 5 [0267.723] lstrcmpiW (lpString1=".docm", lpString2="S.ELM") returned -1 [0267.723] lstrlenW (lpString=".docx") returned 5 [0267.723] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0267.723] lstrlenW (lpString=".dot") returned 4 [0267.723] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1 [0267.723] lstrlenW (lpString=".dotm") returned 5 [0267.723] lstrcmpiW (lpString1=".dotm", lpString2="S.ELM") returned -1 [0267.723] lstrlenW (lpString=".dotx") returned 5 [0267.723] lstrcmpiW (lpString1=".dotx", lpString2="S.ELM") returned -1 [0267.724] lstrlenW (lpString=".dpx") returned 4 [0267.724] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".dqy") returned 4 [0267.724] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".dsn") returned 4 [0267.724] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".dt") returned 3 [0267.724] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1 [0267.724] lstrlenW (lpString=".dtd") returned 4 [0267.724] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".dwg") returned 4 [0267.724] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".dwt") returned 4 [0267.724] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".dx") returned 3 [0267.724] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1 [0267.724] lstrlenW (lpString=".dxf") returned 4 [0267.724] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".edml") returned 5 [0267.724] lstrcmpiW (lpString1=".edml", lpString2="S.ELM") returned -1 [0267.724] lstrlenW (lpString=".efd") returned 4 [0267.724] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".elf") returned 4 [0267.724] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1 [0267.724] lstrlenW (lpString=".emf") returned 4 [0267.724] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1 [0267.724] lstrlenW (lpString=".emz") returned 4 [0267.724] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1 [0267.724] lstrlenW (lpString=".epf") returned 4 [0267.724] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1 [0267.724] lstrlenW (lpString=".eps") returned 4 [0267.724] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1 [0267.724] lstrlenW (lpString=".epsf") returned 5 [0267.724] lstrcmpiW (lpString1=".epsf", lpString2="S.ELM") returned -1 [0267.724] lstrlenW (lpString=".epsp") returned 5 [0267.724] lstrcmpiW (lpString1=".epsp", lpString2="S.ELM") returned -1 [0267.725] lstrlenW (lpString=".erf") returned 4 [0267.725] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".exr") returned 4 [0267.725] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".f4v") returned 4 [0267.725] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".fido") returned 5 [0267.725] lstrcmpiW (lpString1=".fido", lpString2="S.ELM") returned -1 [0267.725] lstrlenW (lpString=".flm") returned 4 [0267.725] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".flv") returned 4 [0267.725] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".frm") returned 4 [0267.725] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".fxg") returned 4 [0267.725] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".geo") returned 4 [0267.725] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".gif") returned 4 [0267.725] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".grs") returned 4 [0267.725] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".gz") returned 3 [0267.725] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1 [0267.725] lstrlenW (lpString=".h") returned 2 [0267.725] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1 [0267.725] lstrlenW (lpString=".hdr") returned 4 [0267.725] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".hpp") returned 4 [0267.725] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".hta") returned 4 [0267.725] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".htc") returned 4 [0267.725] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".htm") returned 4 [0267.725] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1 [0267.725] lstrlenW (lpString=".html") returned 5 [0267.726] lstrcmpiW (lpString1=".html", lpString2="S.ELM") returned -1 [0267.726] lstrlenW (lpString=".icb") returned 4 [0267.726] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".ics") returned 4 [0267.726] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".iff") returned 4 [0267.726] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".inc") returned 4 [0267.726] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".indd") returned 5 [0267.726] lstrcmpiW (lpString1=".indd", lpString2="S.ELM") returned -1 [0267.726] lstrlenW (lpString=".ini") returned 4 [0267.726] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".iqy") returned 4 [0267.726] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".j2c") returned 4 [0267.726] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".j2k") returned 4 [0267.726] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".java") returned 5 [0267.726] lstrcmpiW (lpString1=".java", lpString2="S.ELM") returned -1 [0267.726] lstrlenW (lpString=".jp2") returned 4 [0267.726] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".jpc") returned 4 [0267.726] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".jpe") returned 4 [0267.726] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".jpeg") returned 5 [0267.726] lstrcmpiW (lpString1=".jpeg", lpString2="S.ELM") returned -1 [0267.726] lstrlenW (lpString=".jpf") returned 4 [0267.726] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".jpg") returned 4 [0267.726] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".jpx") returned 4 [0267.726] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1 [0267.726] lstrlenW (lpString=".js") returned 3 [0267.726] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1 [0267.727] lstrlenW (lpString=".jsf") returned 4 [0267.727] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".json") returned 5 [0267.727] lstrcmpiW (lpString1=".json", lpString2="S.ELM") returned -1 [0267.727] lstrlenW (lpString=".jsp") returned 4 [0267.727] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".kdc") returned 4 [0267.727] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".kmz") returned 4 [0267.727] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".kwm") returned 4 [0267.727] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".lasso") returned 6 [0267.727] lstrcmpiW (lpString1=".lasso", lpString2="RS.ELM") returned -1 [0267.727] lstrlenW (lpString=".lbi") returned 4 [0267.727] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".lgf") returned 4 [0267.727] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".lgp") returned 4 [0267.727] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".log") returned 4 [0267.727] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".m1v") returned 4 [0267.727] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".m4a") returned 4 [0267.727] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".m4v") returned 4 [0267.727] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".max") returned 4 [0267.727] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".md") returned 3 [0267.727] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1 [0267.727] lstrlenW (lpString=".mda") returned 4 [0267.727] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".mdb") returned 4 [0267.727] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1 [0267.727] lstrlenW (lpString=".mde") returned 4 [0267.727] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mdf") returned 4 [0267.728] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mdw") returned 4 [0267.728] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mef") returned 4 [0267.728] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mft") returned 4 [0267.728] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mfw") returned 4 [0267.728] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mht") returned 4 [0267.728] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mhtml") returned 6 [0267.728] lstrcmpiW (lpString1=".mhtml", lpString2="RS.ELM") returned -1 [0267.728] lstrlenW (lpString=".mka") returned 4 [0267.728] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mkidx") returned 6 [0267.728] lstrcmpiW (lpString1=".mkidx", lpString2="RS.ELM") returned -1 [0267.728] lstrlenW (lpString=".mkv") returned 4 [0267.728] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mos") returned 4 [0267.728] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mov") returned 4 [0267.728] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mp3") returned 4 [0267.728] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mp4") returned 4 [0267.728] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mpeg") returned 5 [0267.728] lstrcmpiW (lpString1=".mpeg", lpString2="S.ELM") returned -1 [0267.728] lstrlenW (lpString=".mpg") returned 4 [0267.728] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mpv") returned 4 [0267.728] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".mrw") returned 4 [0267.728] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1 [0267.728] lstrlenW (lpString=".msg") returned 4 [0267.728] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".mxl") returned 4 [0267.729] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".myd") returned 4 [0267.729] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".myi") returned 4 [0267.729] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".nef") returned 4 [0267.729] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".nrw") returned 4 [0267.729] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".obj") returned 4 [0267.729] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".odb") returned 4 [0267.729] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".odc") returned 4 [0267.729] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".odm") returned 4 [0267.729] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".odp") returned 4 [0267.729] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".ods") returned 4 [0267.729] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".oft") returned 4 [0267.729] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".one") returned 4 [0267.729] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".onepkg") returned 7 [0267.729] lstrcmpiW (lpString1=".onepkg", lpString2="ERS.ELM") returned -1 [0267.729] lstrlenW (lpString=".onetoc2") returned 8 [0267.729] lstrcmpiW (lpString1=".onetoc2", lpString2="YERS.ELM") returned -1 [0267.729] lstrlenW (lpString=".opt") returned 4 [0267.729] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".oqy") returned 4 [0267.729] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".orf") returned 4 [0267.729] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".p12") returned 4 [0267.729] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1 [0267.729] lstrlenW (lpString=".p7b") returned 4 [0267.730] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".p7c") returned 4 [0267.730] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pam") returned 4 [0267.730] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pbm") returned 4 [0267.730] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pct") returned 4 [0267.730] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pcx") returned 4 [0267.730] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pdd") returned 4 [0267.730] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pdf") returned 4 [0267.730] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pdp") returned 4 [0267.730] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pef") returned 4 [0267.730] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pem") returned 4 [0267.730] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pff") returned 4 [0267.730] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pfm") returned 4 [0267.730] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pfx") returned 4 [0267.730] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".pgm") returned 4 [0267.730] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".php") returned 4 [0267.730] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1 [0267.730] lstrlenW (lpString=".php3") returned 5 [0267.730] lstrcmpiW (lpString1=".php3", lpString2="S.ELM") returned -1 [0267.730] lstrlenW (lpString=".php4") returned 5 [0267.730] lstrcmpiW (lpString1=".php4", lpString2="S.ELM") returned -1 [0267.730] lstrlenW (lpString=".php5") returned 5 [0267.731] lstrcmpiW (lpString1=".php5", lpString2="S.ELM") returned -1 [0267.731] lstrlenW (lpString=".phtml") returned 6 [0267.731] lstrcmpiW (lpString1=".phtml", lpString2="RS.ELM") returned -1 [0267.731] lstrlenW (lpString=".pict") returned 5 [0267.731] lstrcmpiW (lpString1=".pict", lpString2="S.ELM") returned -1 [0267.731] lstrlenW (lpString=".pl") returned 3 [0267.731] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1 [0267.731] lstrlenW (lpString=".pls") returned 4 [0267.731] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".pm") returned 3 [0267.731] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1 [0267.731] lstrlenW (lpString=".png") returned 4 [0267.731] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".pnm") returned 4 [0267.731] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".pot") returned 4 [0267.731] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".potm") returned 5 [0267.731] lstrcmpiW (lpString1=".potm", lpString2="S.ELM") returned -1 [0267.731] lstrlenW (lpString=".potx") returned 5 [0267.731] lstrcmpiW (lpString1=".potx", lpString2="S.ELM") returned -1 [0267.731] lstrlenW (lpString=".ppa") returned 4 [0267.731] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".ppam") returned 5 [0267.731] lstrcmpiW (lpString1=".ppam", lpString2="S.ELM") returned -1 [0267.731] lstrlenW (lpString=".ppm") returned 4 [0267.731] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".pps") returned 4 [0267.731] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1 [0267.731] lstrlenW (lpString=".ppsm") returned 5 [0267.731] lstrcmpiW (lpString1=".ppsm", lpString2="S.ELM") returned -1 [0267.731] lstrlenW (lpString=".ppt") returned 4 [0267.731] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".pptm") returned 5 [0267.732] lstrcmpiW (lpString1=".pptm", lpString2="S.ELM") returned -1 [0267.732] lstrlenW (lpString=".pptx") returned 5 [0267.732] lstrcmpiW (lpString1=".pptx", lpString2="S.ELM") returned -1 [0267.732] lstrlenW (lpString=".prn") returned 4 [0267.732] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".ps") returned 3 [0267.732] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1 [0267.732] lstrlenW (lpString=".psb") returned 4 [0267.732] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".psd") returned 4 [0267.732] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".pst") returned 4 [0267.732] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".ptx") returned 4 [0267.732] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".pub") returned 4 [0267.732] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".pwm") returned 4 [0267.732] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".pxr") returned 4 [0267.732] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1 [0267.732] lstrlenW (lpString=".py") returned 3 [0267.732] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1 [0267.732] lstrlenW (lpString=".qt") returned 3 [0267.732] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1 [0267.732] lstrlenW (lpString=".r3d") returned 4 [0267.732] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1 [0267.732] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.733] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f43878 | out: hHeap=0x2e0000) returned 1 [0267.734] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0267.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.735] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.735] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0267.735] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.735] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.738] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0267.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.739] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.739] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0267.740] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.740] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.740] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0267.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.740] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.740] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0267.740] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.740] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.740] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0267.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.741] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.741] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0267.741] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.741] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.741] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0267.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.741] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.741] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.742] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.742] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.742] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0267.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.742] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.742] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.742] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.743] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.743] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0267.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.743] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.743] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.743] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.743] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.743] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0267.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.744] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.744] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.744] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.744] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.744] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0267.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.744] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.744] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.745] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.745] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.745] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0267.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.745] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.745] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.745] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.745] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.745] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0267.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.746] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.746] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.746] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.746] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.746] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0267.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.746] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.747] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.747] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.747] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.747] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0267.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.747] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.747] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.748] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.748] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.748] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0267.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.748] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.748] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.748] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.748] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.748] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0267.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.749] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.749] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.749] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.749] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.749] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0267.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.749] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.749] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.750] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.750] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.750] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0267.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.750] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.750] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.750] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.750] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.750] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0267.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.750] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.751] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.751] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.751] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.751] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0267.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.751] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.751] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.751] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.751] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.751] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0267.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.752] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.752] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.752] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.752] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.752] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0267.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.752] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.752] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.752] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.752] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.752] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0267.752] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.753] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0267.754] FindNextFileW (in: hFindFile=0x3f02908, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0267.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.760] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.760] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0267.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.761] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.761] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0267.762] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.762] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.762] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0267.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.762] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.762] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0267.762] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.762] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.762] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0267.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.763] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.763] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0267.763] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.763] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.763] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0267.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.763] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.763] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0267.764] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.764] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.764] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0267.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.764] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.764] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0267.764] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.764] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.764] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0267.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.765] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.765] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0267.766] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.766] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.766] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0267.766] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.766] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0267.768] FindNextFileW (in: hFindFile=0x3f02908, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0267.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02ac8 [0267.768] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.768] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0267.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.770] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.770] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0267.770] FindClose (in: hFindFile=0x3f02a88 | out: hFindFile=0x3f02a88) returned 1 [0267.770] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x3f948c8 | out: hHeap=0x2e0000) returned 1 [0267.770] FindNextFileW (in: hFindFile=0x3f02ac8, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0267.770] FindClose (in: hFindFile=0x3f02ac8 | out: hFindFile=0x3f02ac8) returned 1 [0267.770] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x39606e8 | out: hHeap=0x2e0000) returned 1 [0267.772] FindNextFileW (in: hFindFile=0x3f02908, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0267.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a88 [0267.773] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.774] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0267.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7714f8c1, dwReserved1=0x77168dd4, cFileName=".", cAlternateFileName="")) returned 0x3f02b08 [0267.775] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7714f8c1, dwReserved1=0x77168dd4, cFileName="..", cAlternateFileName="")) returned 1 [0267.776] FindNextFileW (in: hFindFile=0x3f02b08, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7714f8c1, dwReserved1=0x77168dd4, cFileName="1033", cAlternateFileName="")) returned 1 [0267.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x354ed84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f02a48 [0267.947] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x354ed84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.947] FindNextFileW (in: hFindFile=0x3f02a48, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x354ed84, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0282.646] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0282.646] FindNextFileW (in: hFindFile=0x3f02a88, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 Thread: id = 21 os_tid = 0x8fc Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3c7a7000" os_pid = "0x89c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x86c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x8ac [0260.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30f7f0 | out: lpSystemTimeAsFileTime=0x30f7f0*(dwLowDateTime=0xe8070d30, dwHighDateTime=0x1d5097a)) [0260.106] GetCurrentProcessId () returned 0x89c [0260.106] GetCurrentThreadId () returned 0x8ac [0260.106] GetTickCount () returned 0x37290 [0260.106] QueryPerformanceCounter (in: lpPerformanceCount=0x30f7f8 | out: lpPerformanceCount=0x30f7f8*=25352407673) returned 1 [0260.107] GetModuleHandleW (lpModuleName=0x0) returned 0x4a780000 [0260.107] __set_app_type (_Type=0x1) [0260.107] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a7a7810) returned 0x0 [0260.108] __getmainargs (in: _Argc=0x4a7ca608, _Argv=0x4a7ca618, _Env=0x4a7ca610, _DoWildCard=0, _StartInfo=0x4a7ae0f4 | out: _Argc=0x4a7ca608, _Argv=0x4a7ca618, _Env=0x4a7ca610) returned 0 [0260.108] GetCurrentThreadId () returned 0x8ac [0260.108] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x8ac) returned 0x3c [0260.108] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0260.108] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0260.108] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0260.109] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0260.109] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f788 | out: phkResult=0x30f788*=0x0) returned 0x2 [0260.109] VirtualQuery (in: lpAddress=0x30f770, lpBuffer=0x30f6f0, dwLength=0x30 | out: lpBuffer=0x30f6f0*(BaseAddress=0x30f000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0260.109] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x30f6f0, dwLength=0x30 | out: lpBuffer=0x30f6f0*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0260.109] VirtualQuery (in: lpAddress=0x211000, lpBuffer=0x30f6f0, dwLength=0x30 | out: lpBuffer=0x30f6f0*(BaseAddress=0x211000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0260.109] VirtualQuery (in: lpAddress=0x214000, lpBuffer=0x30f6f0, dwLength=0x30 | out: lpBuffer=0x30f6f0*(BaseAddress=0x214000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0260.109] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x30f6f0, dwLength=0x30 | out: lpBuffer=0x30f6f0*(BaseAddress=0x310000, AllocationBase=0x310000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0260.109] GetConsoleOutputCP () returned 0x1b5 [0260.109] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a7bbfe0 | out: lpCPInfo=0x4a7bbfe0) returned 1 [0260.109] SetConsoleCtrlHandler (HandlerRoutine=0x4a7a3184, Add=1) returned 1 [0260.110] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.110] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0260.110] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.110] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a7ae194 | out: lpMode=0x4a7ae194) returned 0 [0260.110] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.110] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a7ae198 | out: lpMode=0x4a7ae198) returned 0 [0260.111] GetEnvironmentStringsW () returned 0x488a60* [0260.111] GetProcessHeap () returned 0x470000 [0260.111] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xa7c) returned 0x4894f0 [0260.111] FreeEnvironmentStringsW (penv=0x488a60) returned 1 [0260.111] GetProcessHeap () returned 0x470000 [0260.111] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x8) returned 0x4888e0 [0260.111] GetEnvironmentStringsW () returned 0x488a60* [0260.111] GetProcessHeap () returned 0x470000 [0260.111] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xa7c) returned 0x489f80 [0260.111] FreeEnvironmentStringsW (penv=0x488a60) returned 1 [0260.111] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e648 | out: phkResult=0x30e648*=0x44) returned 0x0 [0260.111] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x0, lpData=0x30e660*=0x18, lpcbData=0x30e644*=0x1000) returned 0x2 [0260.111] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x1, lpcbData=0x30e644*=0x4) returned 0x0 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x0, lpData=0x30e660*=0x1, lpcbData=0x30e644*=0x1000) returned 0x2 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x0, lpcbData=0x30e644*=0x4) returned 0x0 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x40, lpcbData=0x30e644*=0x4) returned 0x0 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x40, lpcbData=0x30e644*=0x4) returned 0x0 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x0, lpData=0x30e660*=0x40, lpcbData=0x30e644*=0x1000) returned 0x2 [0260.112] RegCloseKey (hKey=0x44) returned 0x0 [0260.112] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e648 | out: phkResult=0x30e648*=0x44) returned 0x0 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x0, lpData=0x30e660*=0x40, lpcbData=0x30e644*=0x1000) returned 0x2 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x1, lpcbData=0x30e644*=0x4) returned 0x0 [0260.112] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x0, lpData=0x30e660*=0x1, lpcbData=0x30e644*=0x1000) returned 0x2 [0260.114] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x0, lpcbData=0x30e644*=0x4) returned 0x0 [0260.114] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x9, lpcbData=0x30e644*=0x4) returned 0x0 [0260.114] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x4, lpData=0x30e660*=0x9, lpcbData=0x30e644*=0x4) returned 0x0 [0260.114] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e640, lpData=0x30e660, lpcbData=0x30e644*=0x1000 | out: lpType=0x30e640*=0x0, lpData=0x30e660*=0x9, lpcbData=0x30e644*=0x1000) returned 0x2 [0260.114] RegCloseKey (hKey=0x44) returned 0x0 [0260.114] time (in: timer=0x0 | out: timer=0x0) returned 0x5cd94e04 [0260.114] srand (_Seed=0x5cd94e04) [0260.114] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0260.114] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0260.114] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7bc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0260.115] GetProcessHeap () returned 0x470000 [0260.115] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x218) returned 0x48aa10 [0260.115] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0260.115] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0260.115] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0260.115] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0260.115] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0260.115] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0260.115] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0260.115] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0260.115] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0260.115] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0260.115] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0260.115] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0260.115] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0260.115] GetProcessHeap () returned 0x470000 [0260.115] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4894f0 | out: hHeap=0x470000) returned 1 [0260.115] GetEnvironmentStringsW () returned 0x488a60* [0260.115] GetProcessHeap () returned 0x470000 [0260.115] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xa94) returned 0x48ac30 [0260.115] FreeEnvironmentStringsW (penv=0x488a60) returned 1 [0260.115] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0260.115] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0260.115] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0260.115] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0260.115] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0260.116] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0260.116] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0260.116] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0260.116] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0260.116] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0260.116] GetProcessHeap () returned 0x470000 [0260.116] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x5c) returned 0x48b6d0 [0260.116] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x30f450 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0260.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x30f450, lpFilePart=0x30f430 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f430*="Desktop") returned 0x25 [0260.116] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0260.116] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30f160 | out: lpFindFileData=0x30f160*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x48b740 [0260.116] FindClose (in: hFindFile=0x48b740 | out: hFindFile=0x48b740) returned 1 [0260.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x30f160 | out: lpFindFileData=0x30f160*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x48b740 [0260.118] FindClose (in: hFindFile=0x48b740 | out: hFindFile=0x48b740) returned 1 [0260.118] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0260.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x30f160 | out: lpFindFileData=0x30f160*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9648fa0, ftLastAccessTime.dwHighDateTime=0x1d5097a, ftLastWriteTime.dwLowDateTime=0xd9648fa0, ftLastWriteTime.dwHighDateTime=0x1d5097a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x48b740 [0260.118] FindClose (in: hFindFile=0x48b740 | out: hFindFile=0x48b740) returned 1 [0260.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0260.118] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0260.118] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0260.118] GetProcessHeap () returned 0x470000 [0260.118] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ac30 | out: hHeap=0x470000) returned 1 [0260.118] GetEnvironmentStringsW () returned 0x48b740* [0260.118] GetProcessHeap () returned 0x470000 [0260.118] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xae8) returned 0x48c230 [0260.118] FreeEnvironmentStringsW (penv=0x48b740) returned 1 [0260.118] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7bc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0260.118] GetProcessHeap () returned 0x470000 [0260.118] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b6d0 | out: hHeap=0x470000) returned 1 [0260.118] GetProcessHeap () returned 0x470000 [0260.118] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x4016) returned 0x48cd20 [0260.119] GetProcessHeap () returned 0x470000 [0260.119] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd20 | out: hHeap=0x470000) returned 1 [0260.119] GetConsoleOutputCP () returned 0x1b5 [0260.119] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a7bbfe0 | out: lpCPInfo=0x4a7bbfe0) returned 1 [0260.119] GetUserDefaultLCID () returned 0x409 [0260.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a7b7b50, cchData=8 | out: lpLCData=":") returned 2 [0260.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30f560, cchData=128 | out: lpLCData="0") returned 2 [0260.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30f560, cchData=128 | out: lpLCData="0") returned 2 [0260.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30f560, cchData=128 | out: lpLCData="1") returned 2 [0260.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a7ca740, cchData=8 | out: lpLCData="/") returned 2 [0260.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a7ca4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a7ca460, cchData=32 | out: lpLCData="Tue") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a7ca420, cchData=32 | out: lpLCData="Wed") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a7ca3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a7ca3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a7ca360, cchData=32 | out: lpLCData="Sat") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a7ca700, cchData=32 | out: lpLCData="Sun") returned 4 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a7b7b40, cchData=8 | out: lpLCData=".") returned 2 [0260.120] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a7ca4e0, cchData=8 | out: lpLCData=",") returned 2 [0260.120] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0260.121] GetProcessHeap () returned 0x470000 [0260.121] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20c) returned 0x4895c0 [0260.121] GetConsoleTitleW (in: lpConsoleTitle=0x4895c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0260.121] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.121] GetFileType (hFile=0xf4) returned 0x3 [0260.121] BrandingFormatString () returned 0x4897e0 [0260.240] GetVersion () returned 0x1db10106 [0260.240] _vsnwprintf (in: _Buffer=0x30f6d0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x30f668 | out: _Buffer="6.1.7601") returned 8 [0260.240] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.240] GetFileType (hFile=0xf4) returned 0x3 [0260.240] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a7c6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0260.240] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a7c6340, nSize=0x2000, Arguments=0x30f670 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0260.240] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.240] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0260.240] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x30f5f8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f5f8*=0x24, lpOverlapped=0x0) returned 1 [0260.241] _vsnwprintf (in: _Buffer=0x4a7c6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f698 | out: _Buffer="\r\n") returned 2 [0260.241] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.241] GetFileType (hFile=0xf4) returned 0x3 [0260.241] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.241] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0260.241] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f668, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f668*=0x2, lpOverlapped=0x0) returned 1 [0260.241] _vsnwprintf (in: _Buffer=0x4a7c6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x30f698 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0260.241] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.241] GetFileType (hFile=0xf4) returned 0x3 [0260.241] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.241] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0260.241] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x30f668, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f668*=0x3f, lpOverlapped=0x0) returned 1 [0260.241] _vsnwprintf (in: _Buffer=0x4a7c6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f698 | out: _Buffer="\r\n") returned 2 [0260.241] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.241] GetFileType (hFile=0xf4) returned 0x3 [0260.241] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.241] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0260.241] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f668, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f668*=0x2, lpOverlapped=0x0) returned 1 [0260.241] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0260.241] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0260.241] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0260.242] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0260.242] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.242] GetFileType (hFile=0xe8) returned 0x3 [0260.242] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0260.242] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x30f4c0 | out: TokenHandle=0x30f4c0*=0x0) returned 0xc000007c [0260.242] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x30f4c0 | out: TokenHandle=0x30f4c0*=0x50) returned 0x0 [0260.242] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x30f4d0, TokenInformationLength=0x4, ReturnLength=0x30f4d8 | out: TokenInformation=0x30f4d0, ReturnLength=0x30f4d8) returned 0x0 [0260.242] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x30f4d8, TokenInformationLength=0x4, ReturnLength=0x30f4d0 | out: TokenInformation=0x30f4d8, ReturnLength=0x30f4d0) returned 0x0 [0260.242] NtClose (Handle=0x50) returned 0x0 [0260.242] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x30f4a0, nSize=0x0, Arguments=0x30f4a8 | out: lpBuffer="\x97e0\x48") returned 0xf [0260.242] GetProcessHeap () returned 0x470000 [0260.242] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x218) returned 0x471ab0 [0260.242] GetConsoleTitleW (in: lpConsoleTitle=0x30f4f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0260.242] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0260.243] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0260.243] GetProcessHeap () returned 0x470000 [0260.243] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x471ab0 | out: hHeap=0x470000) returned 1 [0260.243] LocalFree (hMem=0x4897e0) returned 0x0 [0260.244] GetProcessHeap () returned 0x470000 [0260.244] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48aa10 | out: hHeap=0x470000) returned 1 [0260.244] _vsnwprintf (in: _Buffer=0x4a7c6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f1d8 | out: _Buffer="\r\n") returned 2 [0260.244] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.244] GetFileType (hFile=0xf4) returned 0x3 [0260.244] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.244] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0260.244] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f1a8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f1a8*=0x2, lpOverlapped=0x0) returned 1 [0260.244] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0260.244] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7bc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0260.244] _vsnwprintf (in: _Buffer=0x4a7aeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f1e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0260.244] _vsnwprintf (in: _Buffer=0x4a7aebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x30f1e8 | out: _Buffer=">") returned 1 [0260.244] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.244] GetFileType (hFile=0xf4) returned 0x3 [0260.244] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.244] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0260.244] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x30f1d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f1d8*=0x26, lpOverlapped=0x0) returned 1 [0260.245] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.245] GetFileType (hFile=0xe8) returned 0x3 [0260.245] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.245] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.245] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0260.246] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.246] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.246] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0260.246] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.246] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.246] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0260.246] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.246] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.246] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0260.246] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.246] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.246] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0260.246] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.246] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.246] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0260.246] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.246] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0260.247] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.247] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0260.247] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.247] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0260.247] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.247] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0260.247] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.247] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0260.247] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.247] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0260.247] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.247] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.247] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.247] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.248] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.248] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.248] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.248] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.248] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.248] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0260.248] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.248] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.249] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0260.249] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.249] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.249] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0260.249] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.249] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.249] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0260.249] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.249] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.249] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0260.249] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.249] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.249] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0260.249] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0260.250] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.250] GetFileType (hFile=0xe8) returned 0x3 [0260.250] _get_osfhandle (_FileHandle=0) returned 0xe8 [0260.250] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.250] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.250] GetFileType (hFile=0xf4) returned 0x3 [0260.250] _get_osfhandle (_FileHandle=1) returned 0xf4 [0260.250] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0260.250] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x30f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f4b8*=0x18, lpOverlapped=0x0) returned 1 [0260.250] GetProcessHeap () returned 0x470000 [0260.250] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x4012) returned 0x48cd20 [0260.250] GetProcessHeap () returned 0x470000 [0260.250] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48cd20 | out: hHeap=0x470000) returned 1 [0260.250] _wcsicmp (_String1="mode", _String2=")") returned 68 [0260.251] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0260.251] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0260.251] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0260.251] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0260.251] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0260.251] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0260.251] GetProcessHeap () returned 0x470000 [0260.251] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xb0) returned 0x4897e0 [0260.251] GetProcessHeap () returned 0x470000 [0260.251] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1a) returned 0x484610 [0260.251] GetProcessHeap () returned 0x470000 [0260.251] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x38) returned 0x486510 [0260.252] GetConsoleOutputCP () returned 0x1b5 [0260.252] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a7bbfe0 | out: lpCPInfo=0x4a7bbfe0) returned 1 [0260.252] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0260.252] GetConsoleTitleW (in: lpConsoleTitle=0x30f470, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0260.253] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0260.253] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0260.253] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0260.253] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0260.253] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0260.253] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0260.253] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0260.253] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0260.253] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0260.253] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0260.253] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0260.253] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0260.253] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0260.253] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0260.253] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0260.253] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0260.253] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0260.253] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0260.253] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0260.253] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0260.253] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0260.253] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0260.253] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0260.253] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0260.253] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0260.253] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0260.253] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0260.253] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0260.253] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0260.253] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0260.254] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0260.254] _wcsicmp (_String1="mode", _String2="START") returned -6 [0260.254] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0260.254] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0260.254] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0260.254] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0260.254] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0260.254] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0260.254] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0260.254] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0260.254] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0260.254] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0260.254] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0260.254] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0260.254] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0260.254] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0260.254] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0260.254] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0260.254] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0260.254] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0260.254] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0260.254] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0260.254] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0260.254] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0260.254] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0260.254] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0260.254] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0260.254] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0260.254] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0260.254] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0260.254] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0260.254] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0260.254] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0260.254] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0260.254] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0260.255] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0260.255] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0260.255] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0260.255] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0260.255] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0260.255] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0260.255] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0260.255] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0260.255] _wcsicmp (_String1="mode", _String2="START") returned -6 [0260.255] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0260.255] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0260.255] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0260.255] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0260.255] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0260.255] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0260.255] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0260.255] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0260.255] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0260.255] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0260.255] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0260.255] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0260.255] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0260.255] GetProcessHeap () returned 0x470000 [0260.255] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x218) returned 0x471ab0 [0260.255] GetProcessHeap () returned 0x470000 [0260.255] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x42) returned 0x4898a0 [0260.255] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0260.256] GetProcessHeap () returned 0x470000 [0260.256] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x420) returned 0x489a80 [0260.256] SetErrorMode (uMode=0x0) returned 0x0 [0260.256] SetErrorMode (uMode=0x1) returned 0x0 [0260.256] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x489a90, lpFilePart=0x30ed00 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30ed00*="Desktop") returned 0x25 [0260.256] SetErrorMode (uMode=0x0) returned 0x1 [0260.256] GetProcessHeap () returned 0x470000 [0260.256] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489a80, Size=0x66) returned 0x489a80 [0260.256] GetProcessHeap () returned 0x470000 [0260.256] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x489a80) returned 0x66 [0260.256] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0260.256] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0260.256] GetProcessHeap () returned 0x470000 [0260.256] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x128) returned 0x471cd0 [0260.256] GetProcessHeap () returned 0x470000 [0260.256] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x240) returned 0x489b00 [0260.265] GetProcessHeap () returned 0x470000 [0260.265] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489b00, Size=0x12a) returned 0x489b00 [0260.265] GetProcessHeap () returned 0x470000 [0260.265] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x489b00) returned 0x12a [0260.265] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0260.265] GetProcessHeap () returned 0x470000 [0260.265] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xe8) returned 0x485b70 [0260.265] GetProcessHeap () returned 0x470000 [0260.265] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x485b70, Size=0x7e) returned 0x485b70 [0260.265] GetProcessHeap () returned 0x470000 [0260.265] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x485b70) returned 0x7e [0260.267] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0260.267] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0xffffffffffffffff [0260.267] GetLastError () returned 0x2 [0260.267] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0xffffffffffffffff [0260.267] GetLastError () returned 0x2 [0260.267] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0260.267] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0x485c00 [0260.267] GetProcessHeap () returned 0x470000 [0260.267] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x484640 [0260.267] FindClose (in: hFindFile=0x485c00 | out: hFindFile=0x485c00) returned 1 [0260.268] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0x485c00 [0260.268] GetProcessHeap () returned 0x470000 [0260.268] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x484640, Size=0x8) returned 0x4898f0 [0260.268] FindClose (in: hFindFile=0x485c00 | out: hFindFile=0x485c00) returned 1 [0260.268] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0260.268] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0260.268] GetConsoleTitleW (in: lpConsoleTitle=0x30efc0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0260.268] GetProcessHeap () returned 0x470000 [0260.268] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x21c) returned 0x489c40 [0260.268] GetConsoleTitleW (in: lpConsoleTitle=0x489c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0260.268] GetProcessHeap () returned 0x470000 [0260.268] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489c40, Size=0xa8) returned 0x489c40 [0260.268] GetProcessHeap () returned 0x470000 [0260.268] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x489c40) returned 0xa8 [0260.268] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0260.269] GetProcessHeap () returned 0x470000 [0260.269] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c40 | out: hHeap=0x470000) returned 1 [0260.269] InitializeProcThreadAttributeList (in: lpAttributeList=0x30ed78, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30ed38 | out: lpAttributeList=0x30ed78, lpSize=0x30ed38) returned 1 [0260.269] UpdateProcThreadAttribute (in: lpAttributeList=0x30ed78, dwFlags=0x0, Attribute=0x60001, lpValue=0x30ed28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30ed78, lpPreviousValue=0x0) returned 1 [0260.269] GetStartupInfoW (in: lpStartupInfo=0x30ee90 | out: lpStartupInfo=0x30ee90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0260.269] GetProcessHeap () returned 0x470000 [0260.269] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x20) returned 0x484640 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0260.269] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0260.270] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0260.270] GetProcessHeap () returned 0x470000 [0260.270] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484640 | out: hHeap=0x470000) returned 1 [0260.270] GetProcessHeap () returned 0x470000 [0260.270] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x12) returned 0x488900 [0260.270] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x30edb0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30ed60 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x30ed60*(hProcess=0x54, hThread=0x50, dwProcessId=0x7dc, dwThreadId=0x78c)) returned 1 [0260.327] CloseHandle (hObject=0x50) returned 1 [0260.327] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0260.327] GetProcessHeap () returned 0x470000 [0260.327] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48c230 | out: hHeap=0x470000) returned 1 [0260.327] GetEnvironmentStringsW () returned 0x48aa10* [0260.327] GetProcessHeap () returned 0x470000 [0260.327] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xae8) returned 0x48b500 [0260.327] FreeEnvironmentStringsW (penv=0x48aa10) returned 1 [0260.327] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0260.327] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0260.327] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x30e668, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x30e668, ReturnLength=0x0) returned 0x0 [0260.327] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x30e6a0, nSize=0x380, lpNumberOfBytesRead=0x30e660 | out: lpBuffer=0x30e6a0*, lpNumberOfBytesRead=0x30e660*=0x380) returned 1 [0260.328] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0263.162] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x30eca8 | out: lpExitCode=0x30eca8*=0x0) returned 1 [0263.162] CloseHandle (hObject=0x54) returned 1 [0263.162] _vsnwprintf (in: _Buffer=0x30ef18, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ecb8 | out: _Buffer="00000000") returned 8 [0263.163] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0263.163] GetProcessHeap () returned 0x470000 [0263.163] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b500 | out: hHeap=0x470000) returned 1 [0263.163] GetEnvironmentStringsW () returned 0x48aa10* [0263.163] GetProcessHeap () returned 0x470000 [0263.163] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xb0e) returned 0x48eb10 [0263.163] FreeEnvironmentStringsW (penv=0x48aa10) returned 1 [0263.163] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0263.163] GetProcessHeap () returned 0x470000 [0263.163] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48eb10 | out: hHeap=0x470000) returned 1 [0263.163] GetEnvironmentStringsW () returned 0x48aa10* [0263.163] GetProcessHeap () returned 0x470000 [0263.163] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xb0e) returned 0x48eb10 [0263.163] FreeEnvironmentStringsW (penv=0x48aa10) returned 1 [0263.163] GetProcessHeap () returned 0x470000 [0263.163] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x488900 | out: hHeap=0x470000) returned 1 [0263.163] DeleteProcThreadAttributeList (in: lpAttributeList=0x30ed78 | out: lpAttributeList=0x30ed78) [0263.254] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0263.255] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.255] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0263.255] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.255] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a7ae194 | out: lpMode=0x4a7ae194) returned 0 [0263.255] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.255] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a7ae198 | out: lpMode=0x4a7ae198) returned 0 [0263.255] GetConsoleOutputCP () returned 0x4e3 [0263.255] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a7bbfe0 | out: lpCPInfo=0x4a7bbfe0) returned 1 [0263.256] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x485b70 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489b00 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x471cd0 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489a80 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4898a0 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x471ab0 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x486510 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484610 | out: hHeap=0x470000) returned 1 [0263.256] GetProcessHeap () returned 0x470000 [0263.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4897e0 | out: hHeap=0x470000) returned 1 [0263.256] _vsnwprintf (in: _Buffer=0x4a7c6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f1d8 | out: _Buffer="\r\n") returned 2 [0263.256] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.256] GetFileType (hFile=0xf4) returned 0x3 [0263.256] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.256] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0263.256] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f1a8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f1a8*=0x2, lpOverlapped=0x0) returned 1 [0263.257] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0263.257] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7bc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0263.257] _vsnwprintf (in: _Buffer=0x4a7aeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f1e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0263.257] _vsnwprintf (in: _Buffer=0x4a7aebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x30f1e8 | out: _Buffer=">") returned 1 [0263.257] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.257] GetFileType (hFile=0xf4) returned 0x3 [0263.257] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.257] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0263.257] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x30f1d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f1d8*=0x26, lpOverlapped=0x0) returned 1 [0263.257] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.257] GetFileType (hFile=0xe8) returned 0x3 [0263.257] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.257] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.257] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.257] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0263.257] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.257] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.257] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.257] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0263.257] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.257] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.257] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.257] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0263.257] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.257] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.257] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.258] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0263.258] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.258] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.258] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0263.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.259] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.259] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.259] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.260] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.260] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0263.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.260] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.261] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.261] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0263.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.261] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.261] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.261] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0263.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.261] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.261] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.261] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0263.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.261] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.261] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.261] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0263.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.261] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.261] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.261] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0263.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.261] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.261] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.261] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0263.261] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.261] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.262] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.262] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0263.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.262] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.262] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.262] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0263.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.262] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.262] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.262] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0263.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.262] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.262] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.262] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0263.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.262] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.262] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7bc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f4d8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesRead=0x30f4d8*=0x1, lpOverlapped=0x0) returned 1 [0263.262] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7bc320, cbMultiByte=1, lpWideCharStr=0x4a7be366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0263.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.262] GetFileType (hFile=0xe8) returned 0x3 [0263.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0263.262] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.263] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.263] GetFileType (hFile=0xf4) returned 0x3 [0263.263] _get_osfhandle (_FileHandle=1) returned 0xf4 [0263.263] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a7bc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0263.263] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7bc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x30f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4a7bc320*, lpNumberOfBytesWritten=0x30f4b8*=0x24, lpOverlapped=0x0) returned 1 [0263.263] GetProcessHeap () returned 0x470000 [0263.263] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x4012) returned 0x48f630 [0263.263] GetProcessHeap () returned 0x470000 [0263.263] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f630 | out: hHeap=0x470000) returned 1 [0263.263] GetProcessHeap () returned 0x470000 [0263.263] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xb0) returned 0x4897e0 [0263.263] GetProcessHeap () returned 0x470000 [0263.263] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x22) returned 0x484610 [0263.264] GetProcessHeap () returned 0x470000 [0263.264] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x48) returned 0x48aa90 [0263.264] GetConsoleOutputCP () returned 0x4e3 [0263.264] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a7bbfe0 | out: lpCPInfo=0x4a7bbfe0) returned 1 [0263.264] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0263.264] GetConsoleTitleW (in: lpConsoleTitle=0x30f470, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0263.264] GetProcessHeap () returned 0x470000 [0263.264] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x218) returned 0x489910 [0263.264] GetProcessHeap () returned 0x470000 [0263.264] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x5a) returned 0x489b30 [0263.264] GetProcessHeap () returned 0x470000 [0263.264] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x420) returned 0x489090 [0263.264] SetErrorMode (uMode=0x0) returned 0x0 [0263.265] SetErrorMode (uMode=0x1) returned 0x0 [0263.265] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4890a0, lpFilePart=0x30ed00 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30ed00*="Desktop") returned 0x25 [0263.265] SetErrorMode (uMode=0x0) returned 0x1 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489090, Size=0x6e) returned 0x489090 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x489090) returned 0x6e [0263.265] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0263.265] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x128) returned 0x485b70 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x240) returned 0x471ab0 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x471ab0, Size=0x12a) returned 0x471ab0 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x471ab0) returned 0x12a [0263.265] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a7af360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xe8) returned 0x489db0 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489db0, Size=0x7e) returned 0x489db0 [0263.265] GetProcessHeap () returned 0x470000 [0263.265] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x489db0) returned 0x7e [0263.265] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0263.265] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0xffffffffffffffff [0263.266] GetLastError () returned 0x2 [0263.266] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0xffffffffffffffff [0263.266] GetLastError () returned 0x2 [0263.266] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0263.266] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0x489ba0 [0263.266] FindClose (in: hFindFile=0x489ba0 | out: hFindFile=0x489ba0) returned 1 [0263.266] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0xffffffffffffffff [0263.266] GetLastError () returned 0x2 [0263.266] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ea70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ea70) returned 0x489ba0 [0263.266] FindClose (in: hFindFile=0x489ba0 | out: hFindFile=0x489ba0) returned 1 [0263.266] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0263.266] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0263.266] GetConsoleTitleW (in: lpConsoleTitle=0x30efc0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0263.266] GetProcessHeap () returned 0x470000 [0263.267] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x21c) returned 0x489110 [0263.267] GetConsoleTitleW (in: lpConsoleTitle=0x489120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0263.267] GetProcessHeap () returned 0x470000 [0263.267] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489110, Size=0xc0) returned 0x489110 [0263.267] GetProcessHeap () returned 0x470000 [0263.267] RtlSizeHeap (HeapHandle=0x470000, Flags=0x0, MemoryPointer=0x489110) returned 0xc0 [0263.267] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0263.267] GetProcessHeap () returned 0x470000 [0263.267] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489110 | out: hHeap=0x470000) returned 1 [0263.267] InitializeProcThreadAttributeList (in: lpAttributeList=0x30ed78, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30ed38 | out: lpAttributeList=0x30ed78, lpSize=0x30ed38) returned 1 [0263.267] UpdateProcThreadAttribute (in: lpAttributeList=0x30ed78, dwFlags=0x0, Attribute=0x60001, lpValue=0x30ed28, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30ed78, lpPreviousValue=0x0) returned 1 [0263.267] GetStartupInfoW (in: lpStartupInfo=0x30ee90 | out: lpStartupInfo=0x30ee90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0263.267] GetProcessHeap () returned 0x470000 [0263.267] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x20) returned 0x484640 [0263.267] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0263.267] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0263.267] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0263.267] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0263.268] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0263.268] GetProcessHeap () returned 0x470000 [0263.268] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484640 | out: hHeap=0x470000) returned 1 [0263.268] GetProcessHeap () returned 0x470000 [0263.268] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x12) returned 0x488900 [0263.269] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x30edb0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30ed60 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x30ed60*(hProcess=0x50, hThread=0x54, dwProcessId=0x904, dwThreadId=0x900)) returned 1 [0264.157] CloseHandle (hObject=0x54) returned 1 [0264.157] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0264.157] GetProcessHeap () returned 0x470000 [0264.157] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48eb10 | out: hHeap=0x470000) returned 1 [0264.157] GetEnvironmentStringsW () returned 0x48eb10* [0264.157] GetProcessHeap () returned 0x470000 [0264.157] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xb0e) returned 0x48f630 [0264.157] FreeEnvironmentStringsW (penv=0x48eb10) returned 1 [0264.158] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x30e668, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x30e668, ReturnLength=0x0) returned 0x0 [0264.158] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x30e6a0, nSize=0x380, lpNumberOfBytesRead=0x30e660 | out: lpBuffer=0x30e6a0*, lpNumberOfBytesRead=0x30e660*=0x380) returned 1 [0264.158] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x3d8fe000" os_pid = "0x7dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x89c" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x78c Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x38527000" os_pid = "0x904" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x89c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x900 Thread: id = 22 os_tid = 0x63c Thread: id = 23 os_tid = 0x308 Thread: id = 24 os_tid = 0x4ec Thread: id = 25 os_tid = 0x7c8 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x33f0e000" os_pid = "0x7bc" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x904" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007db2a" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x58c Thread: id = 27 os_tid = 0xa74 Thread: id = 28 os_tid = 0xa70 Thread: id = 29 os_tid = 0x7c4 [0282.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc4da20 | out: lpSystemTimeAsFileTime=0xc4da20*(dwLowDateTime=0xf3024510, dwHighDateTime=0x1d5097a)) [0282.525] GetCurrentProcessId () returned 0x7bc [0282.525] GetCurrentThreadId () returned 0x7c4 [0282.525] GetTickCount () returned 0x3ba87 [0282.525] QueryPerformanceCounter (in: lpPerformanceCount=0xc4da28 | out: lpPerformanceCount=0xc4da28*=27594291403) returned 1 [0282.525] malloc (_Size=0x100) returned 0x3c8e80 [0293.003] free (_Block=0x3c8e80) Thread: id = 30 os_tid = 0x744 Thread: id = 31 os_tid = 0x7a4 Thread: id = 32 os_tid = 0x710 Thread: id = 33 os_tid = 0x74c Thread: id = 40 os_tid = 0x9d0 Thread: id = 41 os_tid = 0x48c Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x30414000" os_pid = "0x7b8" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x7bc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007e747" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 34 os_tid = 0x97c Thread: id = 35 os_tid = 0x978 Thread: id = 36 os_tid = 0x974 Thread: id = 37 os_tid = 0x970 Thread: id = 38 os_tid = 0x358 Thread: id = 39 os_tid = 0x574 Thread: id = 42 os_tid = 0xab8